Problem with "NT Event Log" test

[mrw]

Just letting you know this is working now.

Turning off UAC and reboot did not help.
Changing the serviceaccount to administrator did not help either.

But when I set the "Connect As" test property it worked!
First I wrote the account as <domain>\administrator but that didn´t work.
I had to enter the username as administrator@<domain> to get it to work.

Thanks for your help!

//Andreas..

[KS-Soft Europe]

Thank you for the notice!

[KS-Soft]

This is really strange...
1) you are using local IP 127.0.0.1 for the test so "Connect as" is not necessary
2) If RMA could not retrieve information from remote system (e.g. permissions issue), HostMonitor would set Unknown test status, not Ok.
"Ok" status means HostMonitor/RMA retrieved info from Event Log but there is no matched event.


Regards
Alex

[mrw]

The first server I had problem with, the one where the RMA test itself, I did NOT need the Connect As setting. It has started to work as it should, and I´m not sure what I did. A bit strange.
But I have gotten "Bad" testresults now when I user logs in, so I´m happy.

On the remote server I had to use the Connect As.

So now both tests works as I want them to.

[KS-Soft]

On the remote server I had to use the Connect As.

Yes, you need to use Connection Manager or ConnectAs option for all items that check remote Windows systems (well, not Ping or TCP of course)

Regards
Alex

[mrw]

Hi,

I have had my two NT Security log tests(those discussed above) disabled a couple of weeks now, and when I enabled them both give me the reply: "RMA: 301 - EvtNext failed. Not enough storage is available to complete this operation."
I can I fix that?

//Andreas..

[KS-Soft]

Looks like Windows out of resources
http://technet.microsoft.com/en-us/libr ... 78736.aspx

How many handles/threads/GDI objects and memory used by rma.exe (or rma_active.exe) process?
What is the total resource usage on the system?

Regards
Alex

[mrw]

rma_active.exe uses:
Handles: 253
Threads: 10
GDI objects: 0
Memory: 1 969 224 K

Looks like it´s using HUGE amounts of memory, or is this normal for the rma process?

[KS-Soft]

Almost 2GB? No, this does not look normal.
What kind of memory did you check? Commit size? Working set? Private working set?
Windows? 2008?
Service Pack?
3rd party software, antivirus monitors?

RMA version? 4.82?
What tests performed by this agent? ODBC?

Regards
Alex

[mrw]

Kind of memory: private working set
Windows: 2012R2
Service packs: everything from WU
3rd party apps: ClassicShell(can´t use a 2012x without.. ), VMware tools
RMA version: 4.84
Tests performed by it: CPU Usage, Disk Space Usage, Memory Usage(WMI), Ping, Windows service checks, Traffic Monitor, NT Events log.

Other: The server is also a DC.

[KS-Soft]

H'm, may be another bug in Windows 2012...
Could you try to disable Ping and WMI tests and restart RMA?
Also, could you send WMI queries used for these tests to us (support@ks-soft.net), may be we will be able to reproduce the problem.

Regards
Alex

[mrw]

I´m not exactly sure which tests that are WMI tests, but I disabled the Ping tests and the Memory tests which is the only one I know uses WMI. Please be more specific. I don´t have any custom WMI queries.

Restarted the RMA service and now all the enabled tests seems to work, including the NT Eventlog tests.

Rma_active.exe is now using about 280 000 K memory.

[KS-Soft]

If Disk Space test checks remote system (not system where RMA is installed), it uses WMI as well.

Regards
Alex