Issue with scripts/services/evt[application|security|system]

Hello All,

I'm having an issue with the Windows Event Log parsing scripts. I have
a syslog server with a fresh install of CentOS 5.6 with the latest
version of Logwatch (7.4.0). On a Windows system I have installed
SNARE 4.0 and pointed it at my syslog server. I have verified that the
syslog server is receiving messages from the Windows box. To test
logwatch I attempted a number of bad logins on the Windows box. I saw
the failure audits show up in the Event Log and I saw the SNARE
messages come through to the syslog server. However, when I run
logwatch the failures are not reported. I have attempted many
different options and settings in logwatch but all with the same
result. In order to test further I fed the events from the log file
directly to the script as STDIN and the script threw an error for each
line:


Cannot parse Jun 16 13:54:40 it-vm-99 it-vm-99.my.domain.tld
MSWinEventLog[1]:Security 106 Thu Jun 16 13:54:35 2011 529 Security
SYSTEM User Failure Audit IT-VM-99 Logon/Logoff Logon Failure: Reason:
Unknown user name or bad password User Name: baduser Domain: my Logon
Type: 3 Logon Process: NtLmSsp Authentication Package:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: IT-VM-99 93


I have attached the logfile to this email.

Can someone can help me correct this either on the SNARE end or the
logwatch end?

Thanks,

Bill

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel