Eventlog connect to not possible

Hi,

I've got an problem with monitoring the eventlog on another machines via an VPN Connection. The error log says could not connect to "IP-Adress" using username xxx. I changed the system-logon for the service, but still the same problem.
Serverscheck Version 4.4.5

Any Ideas ?

Thanks

Markus Schweizer

Dear Markus,



It might be that Windows Bios information / WMI are blocked in the VPN Connection. This needs to be open in order to remotely access the host.



Regards,



Forum Administrator

Hi,
it's me again, Markus. I tested an vbs Script which uses WMI (Get physical memory), which worked fine on my local computer, but not over the local network and even not over the vpn connection, but the error message was permission denied, so i don't think it is an vpn problem. Maybe it depends on how to connect to the server, normally i should connect with DOMAINUserAccount, but this is not possible in Servercheck ! Or I'am wrong ? I think in english it's called credentials.

Thanks

Markus

You can enter the DOMAINUserAccount in the username field.



If you manually execute the eventlog_check (in the agents directory) what is the output of the log file?



Regards,



Forum Administrator

The event.log says
EVENTCAPTURE ERROR Could not connect to 192.168.x.x using username:blabla EXITING.
Error 1204 The specified network provider name is invalid
The DOMAINUSERNAME syntax gives the same error.

Any Ideas ?

Thanks

Markus

Markus,



does the eventlog check work on a local computer or one that sits in your LAN (so not through the VPN)



Regards,



Forum Administrator

Okay, that's a problem.
Local Server : same error message
local Computer in LAN : same error !

Could this be, because the Service starts with an wrong account ? It starts with an Domain Admin account ...

Strange, or do you know the solution already ?

Kind regards,

Markus

There are multiple reasons:

1. the account you used has no permissions

2. the way you defined your Microsoft security policies block it



Can you run the eventlog_check from the command prompt. You need to have a event.conf file for it. When you run it what is the output in the event.log file?



Regards,



Forum Administrator

1. The account is an Domain Admin Account
2. No policies were defined - it's an testing area

If I run the eventlog_chekc from the command prompt, nothing seems to happen and the output in the event.log i posted 4 posts above. It's the 1204 error message.

helpless regards

Markus

New Day - new try !
I can monitor / check the memory of another machine via vpn and also the CPU!

But not the eventlog.

I think all these are working via WMI, or do is there a difference ?

Any help would be great

Markus