im_msevent keywords datatype wrong | Log collection solutions

#1 tobias42 7 years ago

Hi everybody,

while experimenting with nxlog and relaying windows event logs I stumbled over the issue that even in the latest versions the

field Keywords from the Window log is defined in ms_msevent as integer which doesn't fit the values stored in the field in windows.

Are there any plans to fix this?

best regards

Tobias

Permalink

#2 b0ti Nxlog ✓ 7 years ago

#1 tobias42

Hi everybody, while experimenting with nxlog and relaying windows event logs I stumbled over the issue that even in the latest versions the field Keywords from the Window log is defined in ms_msevent as integer which doesn't fit the values stored in the field in windows. Are there any plans to fix this? best regards Tobias

Yeah, this is in the queue. I suppose it's best to capture it as a string instead.