Windows event log processing

Started by ditonet, July 29, 2016, 11:49:14 AM

Previous topic - Next topic

ditonet

Hello,

In general Windows event log processing work fine for me, but some event are not processed and NetXMS log says:
[DEBUG] LogWatch: Call to EvtFormatMessage failed: error 15027
or
[DEBUG] LogWatch: Call to EvtOpenPublisherMetadata failed

It looks that some event are incomplete (do not contain all fields properly filled) and NetXMS is unable to procces them.
Any ideas how to fix this?

Regards, Grzegorz.

Victor Kirhenshtein

Hi,

error 15027 means "the message resource is present but the message is not found in the string/message table". So application logs message with code that is not present in message table. It looks like a bug in some application.

Best regards,
Victor

ditonet

Thanks Victor,

I made some test, it looks that logged message is incomplete in some way as You wrote.
This is application bug, not NetXMS and I was looking for workaround.

Best regards, Grzegorz.