Eventlog connect to not possible

[Deleted User][Deleted User]

Hi,

I've got an problem with monitoring the eventlog on another machines via an VPN Connection. The error log says could not connect to "IP-Adress" using username xxx. I changed the system-logon for the service, but still the same problem.
Serverscheck Version 4.4.5

Any Ideas ?

Thanks

Markus Schweizer

Comments

  • AdministratorAdministrator
    Dear Markus,



    It might be that Windows Bios information / WMI are blocked in the VPN Connection. This needs to be open in order to remotely access the host.



    Regards,



    Forum Administrator
  • [Deleted User][Deleted User]

    Hi,
    it's me again, Markus. I tested an vbs Script which uses WMI (Get physical memory), which worked fine on my local computer, but not over the local network and even not over the vpn connection, but the error message was permission denied, so i don't think it is an vpn problem. Maybe it depends on how to connect to the server, normally i should connect with DOMAINUserAccount, but this is not possible in Servercheck ! Or I'am wrong ? I think in english it's called credentials.

    Thanks

    Markus

  • AdministratorAdministrator
    You can enter the DOMAINUserAccount in the username field.



    If you manually execute the eventlog_check (in the agents directory) what is the output of the log file?



    Regards,



    Forum Administrator


  • [Deleted User][Deleted User]

    The event.log says
    EVENTCAPTURE ERROR Could not connect to 192.168.x.x using username:blabla EXITING.
    Error 1204 The specified network provider name is invalid
    The DOMAINUSERNAME syntax gives the same error.

    Any Ideas ?

    Thanks

    Markus




  • AdministratorAdministrator
    Markus,



    does the eventlog check work on a local computer or one that sits in your LAN (so not through the VPN)



    Regards,



    Forum Administrator
  • [Deleted User][Deleted User]

    Okay, that's a problem.
    Local Server : same error message
    local Computer in LAN : same error !

    Could this be, because the Service starts with an wrong account ? It starts with an Domain Admin account ...

    Strange, or do you know the solution already ?

    Kind regards,

    Markus

  • AdministratorAdministrator
    There are multiple reasons:

    1. the account you used has no permissions

    2. the way you defined your Microsoft security policies block it



    Can you run the eventlog_check from the command prompt. You need to have a event.conf file for it. When you run it what is the output in the event.log file?



    Regards,



    Forum Administrator
  • [Deleted User][Deleted User]

    1. The account is an Domain Admin Account
    2. No policies were defined - it's an testing area

    If I run the eventlog_chekc from the command prompt, nothing seems to happen and the output in the event.log i posted 4 posts above. It's the 1204 error message.

    helpless regards

    Markus

  • [Deleted User][Deleted User]

    New Day - new try !
    I can monitor / check the memory of another machine via vpn and also the CPU!

    But not the eventlog.

    I think all these are working via WMI, or do is there a difference ?

    Any help would be great

    Markus

This discussion has been closed.