Please note that VisualCron support is not actively monitoring this community forum. Please use our contact page for contacting the VisualCron support directly.


keithdavis
2016-10-14T14:40:48Z
I have never been able to make these work in VisualCron. I can make them work in Task Scheduler. For example, I'm trying to monitor for this on my 2 domain controllers:

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/13/2016 4:56:38 PM
Event ID: 4776
Task Category: Credential Validation
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DC11.pridedallas.com
Description:
The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: ANITA
Source Workstation:
Error Code: 0xC0000064


No matter what I try, it will not trigger on these events (and there are tons of them) happening frequently. We run the VisualCron service as an administrative user. Please don't tell me that it's the Credentials. I'm testing that now and that doesn't seem to solve the problem, but if that is the problem, do everything in our power not to have to use that box, as that means one more place we have to update credentials if we have to change that password.

trigger_main_settings.JPG
trigger_event_log.JPG
Sponsor
Forum information
Support
2016-10-14T15:39:31Z
1. Which version are you using now of VC?
2. Have you tried to limit to only one condition, like Application log?
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2016-10-20T15:16:32Z
8.2.0

Originally Posted by: Support 

2. Have you tried to limit to only one condition, like Application log?



I'm not sure what you mean.

Support
2016-10-20T19:35:32Z
Originally Posted by: keithdavis 

8.2.0

Originally Posted by: Support 

2. Have you tried to limit to only one condition, like Application log?



I'm not sure what you mean.



I am talking about the settings for the Trigger. The filter you use. Anyway, we have identified some problems and will release the fixes for these in 8.2.1. Hopefully next week. I think you should test the latest beta to confirm that it is working for you.
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2016-10-20T19:37:36Z
Originally Posted by: Support 

Originally Posted by: keithdavis 

8.2.0

Originally Posted by: Support 

2. Have you tried to limit to only one condition, like Application log?



I'm not sure what you mean.



I am talking about the settings for the Trigger. The filter you use. Anyway, we have identified some problems and will release the fixes for these in 8.2.1. Hopefully next week. I think you should test the latest beta to confirm that it is working for you.



I get that, but what I mean is you want me to configure it to trigger on any event in the Application Log, is that what you are saying? I don't know if I will have time to test the beta before the release.

Support
2016-10-20T19:39:08Z
Yes, to see which filter is causing the problem. On the other hand, the bug we have identified (and fixed) could potentially cause this problem. I would recommend that you upgrade to the beta as it is mostly bug fixes in general.
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2016-12-02T15:35:05Z
Still not working in 8.2.1.
keithdavis
2016-12-02T15:56:19Z
So I did a test with just using the System log - that worked fine, so I added an Event ID (7036, Service status change), and it no longer works. I've noticed that in the Event ID field, that after I enable the field with "AND", add the number and then save it, when I reopen the trigger, there is a trailing space (image attached). This is the only field that does this and I can remove the space and save and when I reopen it comes back. Maybe that is the problem?

Capture.JPG
Support
2016-12-08T16:27:33Z
No, it should not matter. It is just preventing other characters than numbers. Moving this topic as it is in the wrong forum - hence the long delay in answer.
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2016-12-08T18:18:39Z
Did you already move it? What forum was it in?
Support
2016-12-08T20:12:09Z
Originally Posted by: keithdavis 

Did you already move it? What forum was it in?



It was in the FAQ.
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
ICT admin
2017-02-08T10:56:56Z
Any news on this issue?

We are running version 8.2.3 and are experiencing the same issue.
We have an Error event triggering on another server than the VC server.
Credentials seem to work as we can select the Log file.

Although Errors appear in the Event log, no trigger is fired.

One thing I noticed: when I logoff and login to the VC server, it fires once, but after that does not respond.

Support
2017-02-08T13:37:45Z
Originally Posted by: ICT admin 

Any news on this issue?

We are running version 8.2.3 and are experiencing the same issue.
We have an Error event triggering on another server than the VC server.
Credentials seem to work as we can select the Log file.

Although Errors appear in the Event log, no trigger is fired.

One thing I noticed: when I logoff and login to the VC server, it fires once, but after that does not respond.



I tested with 8.2.4 without an issue. I am thinking it might be related to certain settings in the Trigger. For example, if you just monitor on log "Application" - do you still not see multiple updates?
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
Support
2017-02-08T20:21:33Z
Please test this build, we have made some changes:

http://www.visualcron.co....aspx?g=posts&t=7104 
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
Support
2017-02-10T09:33:05Z
Did you try the latest version?
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2017-06-05T18:41:01Z
These still do not work in 8.2.6.

trigger.JPG events.JPG
Support
2017-06-06T10:08:39Z
Talking about local, remote or both?
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2017-06-06T22:13:55Z
Local - I haven't tried remote.
keithdavis
2017-06-07T12:27:21Z
On top of the fact that this does not work, with the Event Log Trigger enabled, VisualCronService.exe is using 4-5% CPU constantly. I disable it, usage goes away. So even if we fix it, if CPU usage is going to be like that, I can't use these.
Support
2017-06-07T19:20:27Z
Please test this build: http://www.visualcron.co....aspx?g=posts&t=7329 

CPU usage should not be a problem. Let me know if it still is.
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2017-06-07T22:04:08Z
Originally Posted by: Support 

Please test this build: http://www.visualcron.co....aspx?g=posts&t=7329 

CPU usage should not be a problem. Let me know if it still is.



Yea, CPU usage issue is fixed, but the trigger is still not working. Works with "Log file" only, set but not with any other criteria (Event id, Description contains).

Support
2017-06-08T08:33:26Z
Originally Posted by: keithdavis 

Originally Posted by: Support 

Please test this build: http://www.visualcron.co....aspx?g=posts&t=7329 

CPU usage should not be a problem. Let me know if it still is.



Yea, CPU usage issue is fixed, but the trigger is still not working. Works with "Log file" only, set but not with any other criteria (Event id, Description contains).



What you can do is to enable "Extended debugging" in Server settings. Then after event has been created you will see each value it compares with and the value from the event. If you see anything strange please post it here.
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2017-06-08T19:07:34Z
I have no idea why, but suddenly, it's working with Security and 4625, now I need to further filter it on Description, but that is not working. It appears that even though the label is "Description contains:", it's doing equal to, not contains.
Support
2017-06-09T08:29:57Z
Originally Posted by: keithdavis 

I have no idea why, but suddenly, it's working with Security and 4625, now I need to further filter it on Description, but that is not working. It appears that even though the label is "Description contains:", it's doing equal to, not contains.



You are right, we will switch to Contains for the next build. Thanks!
Henrik
Support
http://www.visualcron.com 
Please like  VisualCron on facebook!
keithdavis
2017-08-10T12:23:57Z
So 8.2.8 is now out and I still don't see a fix for the "Contains" issue. Was it just not in the ChangeLog?
Scroll to Top