Getting Data In

Getting info from the details tab within Server 2008 event logs.

JSapienza
Contributor

Does anyone know how to get the full output (including the details tab) or XML version of event logs out of Server 2008?
This is not very helpful in troubleshooting when I don't have the Details section:

Message=For more details for this event, please refer to the "Details" section

My input.conf:

[WinEventLog:Microsoft-Windows-CAPI2/Operational]
disabled = false

Actual captured event:

10/03/2012 03:42:48 PM
LogName=Microsoft-Windows-CAPI2/Operational
SourceName=Microsoft-Windows-CAPI2
EventCode=70
EventType=4
Type=Information
ComputerName=xxxxxxxx
User=SYSTEM
Sid=S-1-5-18
SidType=1
TaskCategory=Acquire Certificate Private Key
OpCode=Info
RecordNumber=207625
Keywords=Private Key
Message=For more details for this event, please refer to the "Details" section

Thanks !

Tags (1)
1 Solution

JSapienza
Contributor

Finally figured this one out. If you use wevtutil to dump the event log to XML it will show all details from the event. So, I ended up using a scripted input like such :

wevtutil qe Microsoft-Windows-CAPI2/Operational "/q:*[System[TimeCreated[timediff(@SystemTime)<=60000]]]" /F:xml

Its very Microsoft to not display the details in the text output and only in the XML format.

View solution in original post

glen_drivas
Explorer

If you use the Splunk Add-on for Microsoft Windows https://splunkbase.splunk.com/app/742/ you can use the following stanza in that app to capture the CAPI2 log.

[WinEventLog://Microsoft-Windows-CAPI2/Operational]
Sourcename=Microsoft-Windows-CAPI2
disabled = 0
renderXml = 1
current_only = 0
0 Karma

JSapienza
Contributor

Finally figured this one out. If you use wevtutil to dump the event log to XML it will show all details from the event. So, I ended up using a scripted input like such :

wevtutil qe Microsoft-Windows-CAPI2/Operational "/q:*[System[TimeCreated[timediff(@SystemTime)<=60000]]]" /F:xml

Its very Microsoft to not display the details in the text output and only in the XML format.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...