Event Log Forwarder - Where is the Audit Failure Type?

Because of changes in the security event logs starting with Windows 2008, you will find these options under the Keywords section:

I have my client setup exactly like that and it doesn't seem to work.  In fact, when I setup a subscription for the Security log the service won't start.  If I delete the subscription it starts again.  Application and System logs work perfectly.

Here is the error message I get when the service won't start.

3/19/2015 9:54:38 AM - Unable to setup Windows Event Log subscribers.  Subscribe failed with error 15001, The specified query is invalid.

3/19/2015 9:54:38 AM - Server Initialization Failed.  See previous event messages for reason.

3/19/2015 9:54:38 AM - SolarWinds Event Log Forwarder for Windows; Service Stopped.

I deleted everything in the gui, and then deleted the .cfg file as well.  Then recreated and had the same result.

How can I be the only one with this problem?  Strange....

Hi ckjtrollen‌,

You are not alone. I tried to replicate this on my end with Win Server 2008. When I select any item under Keywords and then restart the service, it will definitely bomb for an error message. But then when I disable the Keywords, service starts in a blink of an eye. Seems to be a bug on this new version.

That's good news that other people can replicate this problem.  Does Solar Winds read these forums or do I need to reach out to them directly to get this fixed?

thanks all,

I would open a case with support so this issue can be tracked.

Product Manager here, I am looking into this and discussing with R&D, stay tuned.

Just to follow up on this.  I opened a ticket with support and they were able to confirm the bug and I'm waiting on a new version. 

However, now I discovered a problem where if the log viewer clients are using TCP and lose contact with the syslog server, they never try to contact the server again and just fail silently until they are restarted.  The support tech confirmed the problem, but then said that this is now a free tool and is not supported.  I guess I just wasted $300 because this product is so buggy it's useless.

Great that they said that to you, but I am the Product Manager for this and since Log Forwarder comes with Syslog, I get to make the call on if we fix it or not.  Can you send me the ticket number and I will look into this on my side.

Great, thanks.  I hope we can get these issues resolved because they are show stoppers for me.

Case # 783704 - Security Audit Failure bug

Case # 789329 - Event Log Forwarder stops forwarding

In the first item, I am working with R&D on formally addressing, but the workaround is the following.

Manually edit the CFG file and change

<keywords>

<string>Audit Success</string>

<string>Audit Failure</string>

</keywords>

To

<keywords>

<string>0x20000000000000</string>

<string>0x10000000000000</string>

</keywords>

In the first item, I am working with R&D on formally addressing, but the workaround is the following.

Manually edit the CFG file and change

<keywords>

<string>Audit Success</string>

<string>Audit Failure</string>

</keywords>

To

<keywords>

<string>0x20000000000000</string>

<string>0x10000000000000</string>

</keywords>

I can confirm that this does not resolve the issue.  I was able to resolve the issue by removing the Entry for DFS Replication.  I hope that helps.  Thanks

Thanks,

I had same issue today. Thinking to create template on one server and use same on all other machines, but thought to test, if this really works:

Error:

Subscription failed with error 15001, the specified query is invalid.

1. Created a standard subscription (security events)

2. Stopped solarwinds windows event forwarder  service

3. Moved the .cfg file in a new folder

4. Started the solarwinds windows event forwarder service, this created a new file.

5. Stopped the service again

6. Now replaced newly created file with the one created in step 1 (with subscription)

7. started service, it started throwing error

8. Replaced following and it started working with hexadecimal values

Original values:

<string>Audit Success</string>

<string>Audit Failure</string>

new values:

<string>0x20000000000000</string>

<string>0x10000000000000</string>

Seems some bug in version 1.2.0 @Slorwinds, any proper solution of this issue?