Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Server & Application Monitor (SAM) > Events with 0% as the message shows NULL in the Real-Time Event Log Viewer

Events with 0% as the message shows NULL in the Real-Time Event Log Viewer

Updated: September 15, 2016

Overview

When viewing Event Logs from a monitor Windows Workstation/Server using the Real-Time Event Log Viewer, a message which displays "0%" on the Windows Machine reports as NULL via the viewer in SAM.

 

View from SAM:

 

View from Windows Server:

 

Environment

  • All versions of SAM

 

Cause 

This is caused by a WMI not providing the details of the Event Log Message.

 

Resolution

 

  1. Run > wbemtest.
  2. Connect > Connect.
  3. Enter query:

SELECT *
FROM Win32_NTLogEvent
WHERE (LogFile = 'Application') AND (EventCode = 1)

Now you should see the Event Logs populating

   4. Double-click into one of the Event Logs.

   5. Scroll down and find message for the Event Log that's causing the issue "Message" will show "<null>". However, for other event logs, you will see the full message display:

 

 

Last modified
19:42, 14 Sep 2016

Tags

Classifications

Public