Home / user-64725

Mark's questions

Martin Hope
Mark
Asked: 2015-01-15 10:16:09 +0800 CST
  • 1

I am attempting to use nxlog to read and parse IIS logs on Windows Server 2008 r2. Because I have particular requirements for these logs, I would like to use om_exec to send the log entries to a custom tool, where I will do the required work and process them as I need to. My block looks like this:

<Output streamout>
    Module      om_exec
    Command     'dump_input.exe'
</Output>

This configuration results in this error message:

ERROR couldn't execute process 'dump_input.exe'; The parameter is incorrect.

I have tried fully-qualifying the command name, using well-known commands (such as cmd.exe), non-existent commands, anything, and the error is always the same.

Does om_exec work on Windows, and if so, how can I use it?

nxlog
Martin Hope
Mark
Asked: 2014-09-07 13:37:38 +0800 CST
  • 1

I'm using a Samba4 domain controller, and on the machines joined to the domain I'm seeing this message:

The processing of Group Policy failed. Windows attempted to read the file \\mydomain.org\sysvol\mydomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller. 
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
c) The Distributed File System (DFS) client has been disabled.

Running gpupdate gives me the same error. If I open the run box and type notepad \\mydomain.org\sysvol\mydomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini, I get Notepad opened up with the file in it. The contents are these:

[General]
Version=14

Clearly the file exists, and is accessible (by the domain administrator, anyway). The mydomain.org name resovles to the IP address of my domain controller. If I run GPRESULT /H GPReport.html, the resulting file says:

Group Policy Infrastructure failed due to the error listed below.

Access is denied. 

Note: Due to the GP Core failure, none of the other Group Policy components processed their policy. Consequently, status information for the other components is not available.

I've checked the ACL via smbcacls on the domain folder under the sysvol share, and got this output:

pi@dc-rpi1 ~ $ smbcacls //mydomain.org/sysvol mydomain.org -U [email protected]
Enter [email protected]'s password:
REVISION:1
CONTROL:SR|PD|DP
OWNER:MYDOMAIN\Administrator
GROUP:BUILTIN\Administrators
ACL:BUILTIN\Administrators:ALLOWED/OI|CI/FULL
ACL:BUILTIN\Server Operators:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ

If I try to get the ACLs on the gpt.ini file itself, I get this:

pi@dc-rpi1 ~ $ smbcacls //mydomain.org/sysvol mydomain.org/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/gpt.ini -U [email protected]
Enter [email protected]'s password:
REVISION:1
CONTROL:SR|PD|DP
OWNER:MYDOMAIN\Domain Admins
GROUP:MYDOMAIN\Domain Admins
ACL:MYDOMAIN\Domain Admins:ALLOWED/OI|CI/FULL
ACL:MYDOMAIN\Enterprise Admins:ALLOWED/OI|CI/FULL
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:MYDOMAIN\Domain Admins:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\ServerLogon:ALLOWED/OI|CI/READ

Why won't group policy processing work? Are the ACLs not working because my DC isn't running the right filesystem, or some other obscure configuration problem?

domain
Martin Hope
Mark
Asked: 2013-10-23 20:25:55 +0800 CST
  • 0

I'm seeing this error in my event log on my (only) domain controller:

The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 295 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.

To resume replication of this folder, use the DFS Management snap-in to remove this server from the replication group, and then add it back to the group. This causes the server to perform an initial synchronization task, which replaces the stale data with fresh data from other members of the replication group.

In the past (maybe 295 days ago?) there was two domain controllers for a few minutes, while I renamed the domain. This seemed to me the easiest way to accomplish that complex and evidently error-prone task. Now, and for a long time, there has been only one DC in the domain, and that is all there should ever be.

I haven't been able to see how to use the snap-in to remove the server from the replication group, and honestly, I'm not sure I really want to do that, as there is only one server.

What can I do to eliminate this DFSR error?

active-directory