im_msvistalog on Windows not resolving GUID for EventID:4624

Post a different question
2
responses

Hi, is it possibe to resolve GUIDS in EventID:4624
Saw an other post from last year talking about it would be implemented i EE and after that CE.
We currently running ce version and the option for ResolveSID dont work.
Does anyone have a solution for this or a workaround as it looks ok in the Eventviewer where it's resolved correctly.
We currently run nxlog-ce-2.9.1716.

AskedMay 22, 2019 - 8:15am

Answer (1)

ResolveSID exists in the NXLog EE product, but not in CE currently. ResolveGUID will be coming in a future patch for NXLog EE as well.

As for workarounds in CE, you may be able to usexm_perl to cal some wmic commands to return the names.

AnsweredMay 24, 2019 - 4:02pm

Comments (1)

  • TompaHompa's picture

    Hi Zhengshi, so there is no plan to implement ResolveSID in CE?

    Could you please give some example configuration for your workaround?

    Thanks in advance.

    /Tommy

    May 27, 2019 - 8:14am