Trying to create custom data source to collect WSUS logs but when I setup custom data source for error.log it does not align in InTrust 11.4 but I am able to align it in Excel. How to setup custom data source for each type of logs below? Also can this be collected in Real-time need to use Traditional (scheduled job) collection. WSUS Windows Internal Database C:\Windows\WID\Log Erro*.log log_*.trc system_health_*.xel C:\windows\system32\logfiles\httperr Httperr*.log C:\Program Files\Update Services\ Logfiles Change.log SoftwareDistribution.log Also for Windows Firewall log can it be collected in real-time.

Hi Payank Shah, I beg your pardon, but the set of logs you mentioned is so manifold that I cannot give you a certain answer. Generally, the text logs can be configured only in "InTrust Manager" and collected only on schedule, not in real-time. Erro*.log, log_*.trc, system_health_*.xel: these three are from SQL folder, aren't they? Error log can be collected by existing InTrust data source named "Microsoft SQL Server Error Log", other two are binary, not text ones. Under Windows Firewall log do you mean "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" log which can be found in event viewer? (%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx). If yes, then it can be collected both on schedule and in real-time way if you add it in "InTrust Manager" or "InTrust Deployment Manager". All other log names and folders I did not find on my desktop, sorry. I propose the following procedure: Please focus on one log, create a separate topic here on this forum and provide the log example, I mean a dozen of lines from the log . I will grab it and help to create the InTrust Data Source.

InTrust 11.4 Custom Data source

payank shah over 5 years ago

Trying to create custom data source to collect WSUS logs but when I setup custom data source for error.log it does not align in InTrust 11.4 but I am able to align it in Excel. How to setup custom data source for each type of logs below? Also can this be collected in Real-time need to use Traditional (scheduled job) collection.

WSUS

Windows Internal Database

C:\Windows\WID\Log

Erro*.log

log_*.trc

system_health_*.xel

C:\windows\system32\logfiles\httperr

Httperr*.log

C:\Program Files\Update Services\Logfiles

Change.log

SoftwareDistribution.log

Also for Windows Firewall log can it be collected in real-time.

Top Replies

Igor.Ilyin over 5 years ago +1 verified

Hi Payank Shah,

I beg your pardon, but the set of logs you mentioned is so manifold that I cannot give you a certain answer.

Generally, the text logs can be configured only in "InTrust Manager" and…

Parents

0 Igor.Ilyin over 4 years ago

Hi Payank,

Here comes the second and the most complex data source for the the Software Distribution log.
The difficulty with this log resides in multiline events, sometimes an exception stack or a configuration xml are attached to the event.
The longest line I found in your example (shared privately) was 7167 symbols, but not sure this length will not be exceeded in another file.
The default buffer for InTrust CTL data source is 1024 symbols, that's why some actions might be required on your side.
I will provide data sources with 8192 and 16384 buffer which I hope should be enough for all cases.

1. Please unpack the zip

2. Use the InTrustPdoImport utility (you have it on DVD) to import the objects to InTrust configuration:

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Multiline (1024 buffer).xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Multiline Raw (16384 buffer).xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Multiline Raw (8192 buffer).xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Gathering Policy.xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

3. Go to the data source named "SoftwareDistribution Advanced Multiline Raw (16384 buffer)" and on the "Parameters" tab change the path to the one you use on the real system. Close the properties.

4. Create a task using the policy named "SoftwareDistribution Advanced" and the site containing the computer you want to collect from.

5. Run the task

6. Go to Repository Viewer and create a custom search with the filter "Log=SoftwareDistribution" and columns "When", "Source", "Category" and "Description". Also you may add to the grid Insertion Strings 2 to 5. Review the events.

PS:
Once you might experience an issue if the line exceeds 16K (though unlikely), the issue will come as a warning in the gathering session:
Object Name: InTrustServer
Data Source: SoftwareDistribution Advanced Multiline Raw (16384 buffer)
Description: Error occurred while processing file C:\...areDistribution.log. The log file contains an invalid record: "The assembly or..." starting at symbol 11586394.

Workaround:
Copy-Paste the data source and in the properties of the new object change 16384 to 32768, and name this object SoftwareDistribution Advanced Multiline Raw (32768 buffer)
BTW, all these "raw" data sources are just copies of the original data source named "SoftwareDistribution Advanced Multiline (1024 buffer)". This has to be done because the buffer size can be changed only in raw format.

Thank you, waiting for your feedback.

SoftwareDistribution.zip
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Reply

0 Igor.Ilyin over 4 years ago

Hi Payank,

Here comes the second and the most complex data source for the the Software Distribution log.
The difficulty with this log resides in multiline events, sometimes an exception stack or a configuration xml are attached to the event.
The longest line I found in your example (shared privately) was 7167 symbols, but not sure this length will not be exceeded in another file.
The default buffer for InTrust CTL data source is 1024 symbols, that's why some actions might be required on your side.
I will provide data sources with 8192 and 16384 buffer which I hope should be enough for all cases.

1. Please unpack the zip

2. Use the InTrustPdoImport utility (you have it on DVD) to import the objects to InTrust configuration:

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Multiline (1024 buffer).xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Multiline Raw (16384 buffer).xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Multiline Raw (8192 buffer).xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

C:\Temp>InTrustPDOImport.exe -import "SoftwareDistribution Advanced Gathering Policy.xml"
Quest InTrust PDO Import Utility version 11.4.0.3868
Copyright 2018 Quest Software Inc. ALL RIGHTS RESERVED.

Importing ...
Import finished.

3. Go to the data source named "SoftwareDistribution Advanced Multiline Raw (16384 buffer)" and on the "Parameters" tab change the path to the one you use on the real system. Close the properties.

4. Create a task using the policy named "SoftwareDistribution Advanced" and the site containing the computer you want to collect from.

5. Run the task

6. Go to Repository Viewer and create a custom search with the filter "Log=SoftwareDistribution" and columns "When", "Source", "Category" and "Description". Also you may add to the grid Insertion Strings 2 to 5. Review the events.

PS:
Once you might experience an issue if the line exceeds 16K (though unlikely), the issue will come as a warning in the gathering session:
Object Name: InTrustServer
Data Source: SoftwareDistribution Advanced Multiline Raw (16384 buffer)
Description: Error occurred while processing file C:\...areDistribution.log. The log file contains an invalid record: "The assembly or..." starting at symbol 11586394.

Workaround:
Copy-Paste the data source and in the properties of the new object change 16384 to 32768, and name this object SoftwareDistribution Advanced Multiline Raw (32768 buffer)
BTW, all these "raw" data sources are just copies of the original data source named "SoftwareDistribution Advanced Multiline (1024 buffer)". This has to be done because the buffer size can be changed only in raw format.

Thank you, waiting for your feedback.

SoftwareDistribution.zip
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Children

No Data