6
responses
responses
fkochiv
We are running into errors running nxlog-ce on Windows 2016. When is this going to be supported? Our only alternative is to move to Beats which will happen quickly if there is no ETA on this.
Here are some examples of the errors we see:
2018-01-11 14:34:22 WARNING got ERROR_INVALID_PARAMETER (errorcode: 87) for the Security log, will try to reopen in 512 sec. ReadFromLast is TRUE and will try to restart from the last position. This might result in uncollected logs.
2018-01-11 14:34:22 WARNING got ERROR_INVALID_PARAMETER (errorcode: 87) for the Windows PowerShell log, will try to reopen in 512 sec. ReadFromLast is TRUE and will try to restart from the last position. This might result in uncollected logs.=
Comments (6)
The error message is from
im_mseventlogwhich is for windows 2003 and earlier.No this came from our Windows 2016 server...not 2003.
I never said it didn't come from your 2016 server. What I said is that you are using the wrong module on Windows 2016.
Ahhh...what is the correct module for Winevents on 2016?
Is it this? MS EventLog For Windows 2008/Vista And Later (Im_msvistalog)
im_mvistalog is the correct module to use for +2003 Window. However, I'm having problems with that module on Server 2016 and I haven't found a solution yet:
<11>Mar 23 11:32:43 ************ MSWinEventLog 4 N/A N/A Fri Mar 23 11:32:43 2018 N/A nxlog-ce N/A N/A N/A ************ N/A ### ASSERTION FAILED at line 319 in im_msvistalog.c/im_msvistalog_event_to_logdata(): "event != NULL" ### N/A