Our Windows team is forwarding logs from DC's to a server that has the log forwarder on it and it sends logs, in a different format, to a Linux server in SNARE format.
Event log reads as follows. Any ideas?
Log Name: Application
Source: Application Error
Date: 1/4/2021 11:55:18 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: VG1SNIXWPS01.wcs.whitecap.com
Description:
Faulting application name: LogForwarder.exe, version: 1.2.0.114, time stamp: 0x5501140f
Faulting module name: KERNELBASE.dll, version: 10.0.17763.1613, time stamp: 0xa4105fac
Exception code: 0xe0434352
Fault offset: 0x001225f2
Faulting process id: 0x21cc
Faulting application start time: 0x01d6e2e6cbde67ef
Faulting application path: C:\Program Files (x86)\SolarWinds\SolarWinds Event Log Forwarder for Windows\LogForwarder.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: 94c891e3-f9ee-4fb9-a86b-5220410b7735
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-01-05T04:55:18.731707100Z" />
<EventRecordID>3805</EventRecordID>
<Channel>Application</Channel>
<Computer>VG1SNIXWPS01.wcs.whitecap.com</Computer>
<Security />
</System>
<EventData>
<Data>LogForwarder.exe</Data>
<Data>1.2.0.114</Data>
<Data>5501140f</Data>
<Data>KERNELBASE.dll</Data>
<Data>10.0.17763.1613</Data>
<Data>a4105fac</Data>
<Data>e0434352</Data>
<Data>001225f2</Data>
<Data>21cc</Data>
<Data>01d6e2e6cbde67ef</Data>
<Data>C:\Program Files (x86)\SolarWinds\SolarWinds Event Log Forwarder for Windows\LogForwarder.exe</Data>
<Data>C:\Windows\System32\KERNELBASE.dll</Data>
<Data>94c891e3-f9ee-4fb9-a86b-5220410b7735</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>