Kiwi script works with Test button but not with live data

Are there any errors in the Syslog server error log?

Classification: UNCLASSIFIED

Caveats: NONE

Nothing at all that looks relevant in the error log or in the local server logs.

Brian C. Walker (MCSE: Security, A, Network, Security+, BCNE, BCND, VCP5-DCV)

IASO, Information Management Division

Munson Army Health Center

550 Pope Avenue Fort Leavenworth,KS 66027-2332

DSN: 552-6438

OFFICE: 913-684-6438

FAX: 913-684-6399

brian.c.walker1.civ@mail.mil

• • PROPRIETARY & CONFIDENTIAL **  This email and any attachments are confidential and/or proprietary and intended solely for the named recipients. Unauthorized use, copying, or distribution is prohibited. If you received this e-mail in error, please notify me by replying and delete the message without copying or disclosing it. Thank you.

It seems like the data isn't matching so the rule isn't triggering.  What is your filter criteria and does the test and live data match?

Classification: UNCLASSIFIED

Caveats: NONE

Sample from using test button:

2014-03-31 15:42:33 Kernel.Error xxx.xxx.xxx.xxx This is a test message from Kiwi Syslog Server

2014-03-31 15:43:40 Kernel.Error xxx.xxx.xxx.xxx (2x)This is a test message from Kiwi Syslog Server

These are generated from within the script and set to a Display I'm using for debugging - these never make it to the intended final destination display. That may be by design.

Here is a sample message from the actual server event stream:

03-31-2014 14:42:13 Kernel.Error SERVERNAME Mar 31 14:42:13 SERVERNAME.domain MSWinEventLog 3 Application 3589 Mon Mar 31 14:42:13 2014 5 Smart Card Logon N/A Error SERVERNAME.domain 0 An error occurred while retrieving a digital certificate from the inserted smart card. The specified reader name is not recognized.

This message shows up in the intended final destination display. However, it does not show up on the debug display, which would seem to indicate to me that it is completely bypassing my script.

Thanks for trying to help,

Brian C. Walker (MCSE: Security, A, Network, Security+, BCNE, BCND, VCP5-DCV)

IASO, Information Management Division

Munson Army Health Center

550 Pope Avenue Fort Leavenworth,KS 66027-2332

DSN: 552-6438

OFFICE: 913-684-6438

FAX: 913-684-6399

brian.c.walker1.civ@mail.mil

• • PROPRIETARY & CONFIDENTIAL **  This email and any attachments are confidential and/or proprietary and intended solely for the named recipients. Unauthorized use, copying, or distribution is prohibited. If you received this e-mail in error, please notify me by replying and delete the message without copying or disclosing it. Thank you.

Have you resolved this?  If not can you share your filters and actions?