Priority will set not right on german Servers all messages have notice

[GoogleCodeExporter]

What steps will reproduce the problem?
1.All messages from german servers have priority notice.   
2.On english servers the priority depens on the eventlog.

What is the expected output? What do you see instead?
If logons fails on german dcs, i need a priority err.
Instead all messages have priority notice.

What version of the product are you using? On what operating system?
Evtsys_4.3.1_64-Bit

Original issue reported on code.google.com by ronny.bu...@perdata.de on 11 Oct 2010 at 3:59

[GoogleCodeExporter]

Original comment by sherwin....@gmail.com on 12 Oct 2010 at 12:47

[GoogleCodeExporter]

Hallo,

i have make one more tests.
It is not a problem of german language.

I think its the security log on a Windows 2008.
For example "4625: An account failed to log on." and "4625: Fehler beim 
Anmelden eines Kontos." ist only notice. But it should be err. 

Original comment by ronny.bu...@perdata.de on 12 Oct 2010 at 12:00

[GoogleCodeExporter]

Hi Ronny, sorry for the delay, I've just now found time to look into this. The 
problem has to do with how Windows looks at Security events. If you look in 
event viewer at the events in question and check their "Level" field you will 
see it says Information. It says that for every event currently in my eventlog 
on a Server 2008 box. The Audit Success/Failure field is actually stored in the 
Keyword section. I have no idea why it is set up in this way, but right now my 
utility translates all information message into Notices.

I have a couple solutions I can think of that can help your issue, but I'll 
have to think about it some more before I select one. I can either allow users 
to edit certain events to have a particular level using the config file, or I 
can code for Failures in the Security log and cause them to have a Warn or 
Error level.

Thanks for bringing this to my attention. Let me know if you have any other 
suggestions.

-Sherwin

Original comment by sherwin....@gmail.com on 4 Nov 2010 at 4:29

[GoogleCodeExporter]

Hi Ronny, this should now be resolved. Try version 4.4
Let me know if this does not resolve the issue.

Thanks,

Sherwin

Original comment by sherwin....@gmail.com on 29 Nov 2010 at 7:15

• Changed state: Verified