SEM Agent Connectors Not Reading the Windows Event Log

10/31/2018 5:06 PM

10/31/2018 5:06 PM

If the Security Event Manager (formerly Log & Event Manager) agent has been installed, and the Application, System, and Security connectors have been configured, SEM should be receiving the events from those logs. This article will help you ensure that the connectors are configured, and the service has access to each log. See detail below.

If you are able to read these logs but there are no events in the logs, this is a Windows problem.

• It's possible that Windows is broken, preventing logging, so be sure to check Microsoft documentation for assistance.
• Also check the auditing policies set up in group policies. See the following SolarWinds article:Audit Policies and Best Practices for SEM

In its simplest form, SEM agent connectors read the Windows event logs.

Security Event Manager

-SEM Agent doesn't have permission to the Windows Event
-Windows Event is not working properly

SEM Agent must have proper permissions 

SEM Agent must first be installed with the proper permissions for the connectors to collect logs and give the events to the agent for sending to SEM.

• If necessary, uninstall the agent from Programs & Features (or use the SEM Agent uninstaller), and delete the agent directory (C:\windows\syswow64\ContegoSPOP\).
• Then copy the agent installer to the local hard drive, right-click to select "Run as administrator", and follow the prompts to re-install the agent. Whether this is the Remote Agent installer or the Local Agent installer, "Run as administrator" requires the installer file to be on a local hard drive when you launch it.

SEM Agent must have access to the Windows Event Log 

SEM Agent uses the SYSTEM account to read the Windows event logs. Group policies (or local policies, or registry changes) can restrict access to any Windows Event Log.

Note the error message when accessing the event log with your login "...access denied...". This confirms that your user account does not have access to the event log, but we also need to verify that the SEM agent (which uses the SYSTEM account) has the access to read the event log.

The regedit image below shows the Application log being selected, but you can also see the Security and System 'log lines' under the "EventLog" in the registry. The registry access to this is located at:  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog

Perform these steps:

1. Open regedit.exe as an administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application.
3. Right-click Application, and then choose Permissions.
4. Click Advanced, and then click Add.
5. Click the "Select a principal" hyperlink.
6. Click Locations to change focus from the domain/forest to the computer/server.
7. Click Object Types to make sure that the "Other objects" category is checked.
8. In the Name field, type NT SERVICE\EventLog, click Check Names, and then click OK.
9. Ensure the following options are checked (under Show Advanced Permissions): Query Value, Enumerate Subkeys, Notify and Read Control.

Since the SEM agent uses the Windows SYSTEM account, be sure this user has the permissions.
Otherwise you may need to use a "domain admin" service account for the Agent service, and be sure the user (service account) has logon-as-a-service right.

 

 

Microsoft Reference links: 

• https://social.technet.microsoft.com/Forums/en-US/d4f68797-685e-479e-8f4c-84e1d0a4869c/server-2012-foundation-eventlog-registry-permissions?forum=winserver8gen (© 2017 Microsoft, available at https://social.technet.microsoft.com, obtained on November 2, 2017)
• https://blogs.technet.microsoft.com/janelewis/2010/04/30/giving-non-administrators-permission-to-read-event-logs-windows-2003-and-windows-2008/ © 2017 Microsoft, available at https://blogs.technet.microsoft.com, obtained on November 2, 2017)
• https://technet.microsoft.com/en-us/library/2008.06.srp.aspx (© 2017 Microsoft, available at https://technet.microsoft.com, obtained on November 2, 2017)

Make note of the following:

• Microsoft changed the type of security event log used, starting with Vista and going forward. SEM configuration for agents shows "Vista Security Log", which reflects the newer type of event log. This is important to have the correct connector reading this log, not the "Security Log" which reads the Windows 2000/2003 & XP security logs. Just for information, SEM security log connectors parse 100% of the security event log (the only exception being the Windows Platform Event 'noise', which has no value).
• Windows still uses the same System Log as before, so be sure to configure that connector. This connector parses the generic events generated by Windows, so it does not parse 100% of the log.
• Windows still uses the same Application Log as before, so be sure to configure that connector. This connector parses the generic events generated by Windows, so if you need to read more 'informational' logging, contact SolarWinds support for the "Windows Application - All" event log connector. This connector is not normally included with SEM, just because of the additional amount of logging that would appear, if this connector was used by mistake.
• Because of the amount of applications and software available for Windows, the standard application log connector (or even the 'application - all' connector) cannot parse 100% of the log, so SEM has a large number of connectors available to read third party events sent to this log. Most are available under the connector list within the agent configurations.
• If GPO's or local registry changes were made, it's possible that SEM connectors may not be able to be read Windows Event Logs. If you are still unable to read the events into SEM, contact SolarWinds support.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.