Home / server / Questions

Questions[windows-event-log](server)

Martin Hope
Greg B
Asked: 2012-07-16 13:25:26 +0800 CST
  • 65

I've just deployed an update to an existing ASP.NET MVC3 site (it was already configured) and I'm getting the IIS blue screen of death stating

HTTP Error 500.0 - Internal Server Error
The page cannot be displayed because an internal server error has occurred.

However; there is nothing showing up in the Application Event Log where I would expect to see a (more) detailed description of the entry.

How can I go about diagnosing this issue?

iis-7.5 asp.net-mvc windows-event-log 500-error
Martin Hope
YWCA Hello
Asked: 2012-01-22 10:43:56 +0800 CST
  • 13

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the /var/log/messages file, repeating over and over, up to the point of the reboot:

Jan 21 06:53:01 PBX kernel: audit: backlog limit exceeded
Jan 21 06:53:01 PBX kernel: audit: audit_backlog=321 > audit_backlog_limit=320
Jan 21 06:54:01 PBX kernel: printk: 8 messages suppressed.
Jan 21 06:54:01 PBX kernel: audit: audit_backlog=321 > audit_backlog_limit=320
Jan 21 06:54:01 PBX kernel: audit: audit_lost=1130 audit_rate_limit=0 audit_backlog_limit=320

I read on another forum that the following command could identify the source of the backlog traffic:

[root@PBX log]# aureport --start today --event --summary -i

Event Summary Report
======================
total  type
======================
486  USER_ACCT
486  CRED_ACQ
486  USER_START
485  LOGIN
477  CRED_DISP
477  USER_END
6  USER_LOGIN
3  USER_AUTH
2  CONFIG_CHANGE
2  CRED_REFR
1  DAEMON_START

Can anyone advise me as to what next steps I should take in preventing this issue from happening again? I'm not particularly familiar with the purpose of the backlog or what the output of the event summary report means.

linux centos audit windows-event-log
Martin Hope
Jeff Miles
Asked: 2009-05-07 12:27:37 +0800 CST
  • 13

One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server.

This is working great, however it would be ideal if in the message body, the Event contents could be placed. I have tried using $eventdescription and %eventdescription%, but those are just shots in the dark. Any amount of googling produces no results.

Does anyone know if this is possible?

Update: Sparks' suggestion below is a step in the right direction I believe, however that method doesn't seem to work for all values. For example, I can pull the RecordID, Severity and Channel as shown, but I can't use the same method to retreive the EventID, or most importantly the description.

Here's the raw XML from one event:

[Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"]
  [System]
    [Provider Name="DFSR" /] 
    [EventID Qualifiers="16384"]4412[/EventID] 
    [Level]4[/Level] 
    [Task]0[/Task] 
    [Keywords]0x80000000000000[/Keywords] 
    [TimeCreated SystemTime="2009-05-14T18:18:09.000Z" /] 
    [EventRecordID]45692[/EventRecordID] 
    [Channel]DFS Replication[/Channel] 
    [Computer]servername.domain.com[/Computer] 
    [Security /] 
    [/System]
  [EventData]
    [Data]9046C3F4-843E-4A53-B941-4B20764072E5[/Data] 
    [Data]D:\departments\Geomatics\Plan Quality\Data Processing\CG3533017 2009-05-13 KT FIXED[/Data] 
    [Data]D:\departments[/Data] 
    [Data]{26D5F604-E603-4F87-8EC3-DE9A945DA8FD}-v927199[/Data] 
    [Data]Departments[/Data] 
    [Data]domain.ca\files\departments[/Data] 
    [Data]B8242CE2-F5EB-47DA-BA5B-1DD2F7EE3AB9[/Data] 
    [Data]DFAA7A54-66CB-4C31-81A0-0F861382C32C[/Data] 
    [Data]CG3533017 2009-05-13-{26D5F604-E603-4F87-8EC3-DE9A945DA8FD}-v927199[/Data] 
  [/EventData]
 [/Event]

I have tried using a ValueQuery for EventData, but it returns no data.

windows-server-2008 windows-event-log