QUESTION
How to enable collection of Windows Events in Traverse.
RESOLUTION
Traverse needs to be configured to receive Windows events.
%TRAVERSE_HOME% refers to the Traverse installation directory.
On the BVE:
* copy %TRAVERSE_HOME%\etc\messages\winevent\00_src_winevt_log.xml to %TRAVERSE_HOME%\plugin\messages.
* edit %TRAVERSE_HOME%\plugin\messages\00_src_winevt_log.xml and change
<enabled>false</enabled>
to
<enabled>true</enabled>
Please save the file (note - you may need appropriate privileges to save the file - you may save it to a temporary location and then copy/overwrite %TRAVERSE_HOME%\plugin\messages\00_src_winevt_log.xml
* wait a few minutes for the file to be synchronized to all other DGE and DGE
* restart the Message Handler component on the DGE/DGEX.
Note that the Server from which events are received must be configured in Traverse as a device and must be set up with at least one WMI test with local credentials. Once at least one WMI test has been provisioned, the Traverse Windows Event Listener will automatically start receiving events from the server.
Troubleshooting:
In case you do not receive the events from the Windows machine, please perform the following troubleshooting steps:
Using a client such as putty - set up putty to log output to a file and telnet to the Traverse DGE server on port 7668. Once you connect, hit return a few times, then login as follows:
login wmiuser fixme
At the . prompt, next type
list
If you see the response
OK List Follows for 0 entries (0 unreachable):
The O entries indicates that the Event Listener is not listening for events on any of the Windows server monitored by that DGE.
To try and remedy the issue, please follow the steps here:
From the Traverse Service Controller,
* Stop the Message Handler component
* Stop the Event Listener component
* Start the Message Handler component
* Start the Event Listener component
Give it a few minutes and once again connect over port 7668 and determine if you can list the servers.
If you see a list of servers:
please ensure that the server you expect to see is listed there and no failure is indicated.
If the server is not listed, please make sure you have at least one WMI test configured with local credentials
If the server is listed with failed credentials, please ensure that you have the correct local credentials set up on the server.
Assuming the server is listed and there is no message indicating an error:
While connected:
Generate an event on the target machine
See if the event is displayed on the connected session. (If there is a lot of traffic, you may have to open the putty log file and look for the generated event there)
Please update the support ticket with your findings.
APPLIES TO
All versions of Traverse.
REFERENCE
None.