Frequently Asked Questions
Purchasing & Licensing -
Can I try your products before I buy?
Yes! You can download a fully functional 30 day free trial of any of our products. Please go to the 'Download' menu to download the product you are interested in. If you wish to continue using your software after the 30 day trial period you will need to purchase a license key.
[Back to top] -
How many licenses do I need?
A single license entitles you to install our software on a single computer. You can use that installation to monitor as many logs and PC's/Servers as system and network resources allow.
There is no need to install any software on monitored PC's/Servers.
Please see the "Scalability, Installation, Upgrading and Backup" section of this knowledge base for more information on scalability and information to help you decide how many installations of LogMeister/EventMeister you will need.
[Back to top] -
How do I purchase LogMeister products?
All of our orders handled by our partners Share-it and Plimus, both trusted names in on-line payment processing. The quickest and easiest way to pay is by Credit or Debit card. Simply follow the 'Buy Now' or 'Purchase' links on our product pages to make your purchase.
[Back to top] -
What payment options are available?
We accept payment (via Share-it or Plimus) by:
- Credit or debit card
- Purchase Order
- Cash
- Check/Cheque
- Wire Transfer
[Back to top] -
What currencies do you accept?
Share-it accept payment in US Dollars, Euro, Pound Sterling, Australian Dollars, Japanese Yen, Canadian Dollars, or Swiss Francs.
There are also display currencies, which allow you to see product prices converted into additional currencies during the online order process for reference purposes.
Plimus accept payment in virtually all currencies
[Back to top] -
When do I receive my software and registration key?
You can download your software either before or after making your payment. Please go to the 'Download' menu to download the product you are interested in. Alternatively you can click on any of the "Try Now" links on our product pages. Your software will function normally for 30 days, after which time you will need to purchase and enter a registration key.
You will receive a temporary registration key by email as soon as your payment is accepted. This will give you an extra 20 days use of our software. We will send you a permanent registration key within 48 hours of receiving your order.
IMPORTANT NOTE: If you've made a payment but have not received a confirmation email and registration key within 48 hours, please contact us at support@tlhouse.co.uk providing a valid return address. A delay could mean that the e-mail address given in your order form was invalid, or that our messages are being blocked by spam filters.
[Back to top] -
Do you offer bulk discounts or site licenses?
Yes. Discounts for up to five licences are displayed on our product purchase pages. For larger orders please contact us with details of your requirements and we'll inform you of the discount schemes that we can offer you.
[Back to top] -
Do you offer a money back guarantee?
Yes. If you are not entirely satisfied with our products simply let us know within 30 days and we'll issue a full refund.
Please note that because of the charges we incur when issuing refunds we cannot extend this offer to bulk purchases (More than 5 licenses). However, we will happily provide you with an extended trial so that you can satisfy yourself that our products meet your requirements before you make your purchase.
[Back to top]
Security Log Monitoring -
How do I monitor succesful logons?
All successful logons are Event ID 528 entries in the security log*.
The following filter (either a feed, view or notification filter) would pick
up 528 entries:

*Event ID 540 is a successful Network Logon (Windows 2000, XP, 2003 Only)
You may wish to narrow things down a little by filtering according to logon
type.
Logon types are as follows:
- Type 2 : Console logon - interactive from the computer console
- Type 3 : Network logon - network mapping (net use/net view)
- Type 4 : Batch logon - scheduler
- Type 5 : Service logon - service uses an account
- Type 7 : Unlock Workstation
So for example you were only interested in attempts to logon from a console
you might use the following filter:

NOTE: These items will only appear in your event logs if auditing
is turned on and you are auditing successful logons.
[Back to top] -
How do I monitor failed logon attempts?
The unsuccessful logon events are:
- Event ID 529 : Unknown user name or bad password
- Event ID 530 : Logon time restriction violation
- Event ID 531 : Account disabled
- Event ID 532 : Account expired
- Event ID 533 : Workstation restriction - not allowed to logon at this computer
- Event ID 534 : Inadequate rights - The user has not been granted the requested
logon type at this machine.
- Event ID 535 : Password expired
- Event ID 536 : NetLogon service down
- Event ID 537 : unexpected error
- Event ID 539 : Logon Failure: Account locked out
- Event ID 627 : NT AUTHORITYANONYMOUS is trying to change a password
- Event ID 644 : User account Locked out
[Back to top]
Service Component -
The service will not start
If the service fails to start, the most likely cause is a logon error (1069).
This typically arises for two reasons:
1) The password entered for the service installation account was incorrect,
or has been changed subsequently. In this case either re-install your LogMeister
product and enter the correct password, or manually change the password for
the service via the Services control panel.
OR
2) The account used for the installation does not have a password. Some versions
of Windows allow a service to be installed to an account that has no password,
others (e.g. XP) do not. In this case, please create a password for the account
in question, then either re-install your LogMeister product or manually set
the password for the service via the Services control panel.
One other reason for a logon failure when starting the service on a Windows
2000 computer is a lack of the "Log on as service" right. The installer
attempts to grant this right automatically using the NTRights utility, but one
user has reported that it was still necessary to add this right manually using
the local security policy editor.
If you're sure that you've set the correct account name and password but the
service is still giving a logon error, open the security policy editor (type
secpol.msc into the Run box) and make sure the account has the "Log on
as service" right.
[Back to top] -
The service is running but the application claims that it isn't
A This typically occurs if the service was started after the application. Please quit the application, verify that the service is running in the Windows Service Manager then restart the application.
[Back to top]
Scalability, Installation, Upgrading & Backup -
How do I backup settings and data?
The bulk of LogMeister's** settings are stored in a sub-directory
of the "Application Data" folder that is specific to
the account under which LogMeister runs, e.g.
C:Documents and Settings<>Application
DataTechnology LighthouseLogMeister
A fast way to get there on XP/2K/2003 is to type %appdata% into
the Run box off the Start menu, and navigate down through "Technology
LighthouseLogMeister"
- Quit LogMeister so that it doesn't change any data during backup
- Take
a backup of the entire LogMeister directory.
**The procedure for backing up EventMeister, TextMeister or ICFMeister are the same - just use the relevant application name in place of LogMeister
[Back to top] -
How do I upgrade to the latest version?
When upgrading there is no need to uninstall the existing version. It is advisable however to quit the existing application and stop the service component (if in use), and take a backup of your feed and notification definitions (See "How do I backup settings and data?" above).
[Back to top] -
How do I transfer my installation to another computer?
If you wish to move your installation to another computer
you can simply take a backup of your existing data files folder
(see "How do I backup settings and data?" above) and overwrite
the corresponding directory on the target machine. This will only
transfer feed and notification settings and data. You will need
to manually re-enter configuration options such as email settings,
startup options, etc.
- Quit your existing installation so that it doesn't
change any data during transfer
- Take a backup of the entire LogMeister (or EventMeister/TextMeister/ICFMeister) directory (keep a second
copy of this just in case!).
- Overwrite the corresponding directory on the target computer.
- Install the application on the target computer.
Your fresh installation should now have all of your
existing feed and notification settings.
[Back to top] -
Can I upgrade from EventMeister/TextMeister/ICFMeister to LogMeister without loosing settings and data?
If you wish to upgrade to LogMeister from EventMeister, TextMeister
or ICFMeister but retain your existing settings you simply need
to rename your application data folder to "LogMeister" before
installing LogMeister. This will only transfer feed and notification
settings and data. You will need to manually re-enter configuration
options such as email settings, startup options, etc.
- Quit your existing EventMeister/TextMeister/ICFMeister
installation so that it doesn't change any data during transfer
- Take a backup of the entire EventMeister/TextMeister/ICFMeister
directory (see 'backing up data' above).
- Rename the EventMeister/TextMeister/ICFMeister
directory to LogMeister
- Install LogMeister
Your fresh LogMeister installation should now have all of
your EventMeister/TextMeister/ICFMeister feed and notification
settings.
[Back to top]
Filter / Notification Rules - monitoring specific items in logs -
How do I display all Errors and Warnings but exclude everything else?
There are two ways that you can do this:
- Create 2 filter rules as follows:

Be sure to select an 'OR' operator to join the two rules!
OR
- Create a single filter rule as follows:

Be sure to check the 'treat as regular expression' checkbox when you define the constraint!
[Back to top] -
How do I display all 101 and 102 errors that occur in a specific date range?
There are two ways that you can do this:
- Create two filter rules as follows:
When defining the constraints, be sure to check the "Treat as regular expression" for the first rule, and select "In Date/Time Range" for the second.
OR
- Create three filter rules as follows:
The two rules pertaining to the Event ID should be joined by an 'OR' operator and grouped. (Just select the two rules then click on the 'Group' button).
Be sure to select the "IN Date/Time Range" option when defining the constraint for the Date rule.
Select an 'AND' operator between the grouped Event ID rules and the Date rule.
[Back to top]
Feeds - Monitoring Logs -
Our software writes to a log file but every hour/day the log file name change how can I monitor such a log?
If a log is distributed across one or more files, you can tell LogMeister how
to recognize the logs. You can either specify the names of all the logs that are
to be used, or you can enter a file spec and/or regular expression that will match
the necessary file names.
For example:
If you wanted to match the files mylog1.txt, mylog2.txt.....mylog9.txt:
'*.*' entered into the 'Spec' text box would match mylog1.txt, mylog2.txt,
and so on, but also someotherfile.exe and someothertextfile.txt
'mylog*.txt' would match mylog1.txt, mylog2.txt, and so on, but also
mylog99.txt.
You can further refine file selection by entering a regular expression in the
'Filter by regular expression' text box.
For example:
'mylog[1-9]\.txt' would limit both of the above file specifications to
match only files in the range mylog1.txt to mylog9.txt
You will be given the opportunity to do this on the first page of the Text
Log Feed Wizard - just check the 'Other Files' box and enter your filenames
or your regular expression in the boxes provided.
LogMeister will only process the files that have been modified since the last
polling period. The time taken to check whether a file has been modified is
negligible, so in your situation LogMeister will effectively monitor the most
recent log only.
[Back to top]
Trouble Shooting -
I can't read Event Logs through the Windows XP Firewall
As you probably know already, XP service pack 2 (SP2) includes an improved version
of the Windows Firewall which is now enabled by default.
In its default configuration, the Windows Firewall prevents access to event
logs from across the network. This will typically be reported by LogMeister/EventMeister
as "access denied".
In order to restore access, you'll have to configure the firewall on your XP
SP2 computers to allow remote administration (aka WMI).
The simplest way to do this is to open up a command prompt and type the following:
netsh firewall set service RemoteAdmin
The effect is immediate - no need to restart.
To read more about this, consult the following Microsoft article:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/connecting_through_windows_firewall.asp
[Back to top] -
I'm getting an Access Denied Error - why?
Both EventMeister and LogMeister use a Microsoft technology known as WMI to access
the logs on your networked computers. The most common error reported by the operating
system for WMI problems is Access Denied. As you might have guessed, there are
many causes for Access Denied. Here's a quick run down of some of the more common
ones. You'll find a longer list, with more suggested solutions, in the Troubleshooting
section of the Help.
- If reading logs from another computer on the network, make sure that the
user and password you have supplied for each feed correspond to an administrator
account on the target computer. That account MUST have a non-blank password.
- Check that DCOM is enabled on both the host and the target PC. Check the
following registry value on both computers:
Key: HKLMSoftwareMicrosoftOLE, value: EnableDCOM, should be set to 'Y'
- Check that WMI is installed. WMI is present by default in all flavors of
Windows 2000 and later operating systems, but must be installed manually on
NT4 systems.
To check for the presence of WMI, type "wbemtest" into the Run box
(Start Menu). If the WMI Tester application starts up, then WMI is present,
if not, it must be installed. Consult the Troubleshooting section of the Help
for details.
- Ensure that WMI permissions have been set correctly. Please consult the
Troubleshooting section of the Help for details.
- On a Windows XP Pro computer, make sure that remote logons are not being
coerced to the GUEST account (aka "ForceGuest", which is enabled
by default computers that are not attached to a domain). To do this, open
the Local Security Policy editor (e.g. by typing 'secpol.msc' into the Run
box, without quotes). Expand the "Local Policies" node and select
"Security Options". Now scroll down to the setting titled "Network
access: Sharing and security model for local accounts". If this is set
to "Guest only", change it to "Classic" and restart your
computer.
- Also on an XP computer running SP2, configure the firewall to allow remote
administration. To do this, open a command prompt and type: netsh firewall
set service RemoteAdmin
- If you have other internal firewalls on your network, you may have to configure
them to allow WMI messages. Again, you'll find advice on how to do this in
the troubleshooting section of the Help.
Even if you are not knowingly running any firewall software, bear in mind
that big-name antivirus solutions such as those produced by McAfee and Symantec
often contain their own firewall functionality. If such software is not properly
configured to allow WMI traffic, then this may be the cause of the problem.
- Make sure that no remote access or WMI-related services have been disabled.
On an XP machine, the following services should be running (or at least allowed
to start on demand):
COM+ Event System
Remote Access Auto Connection Manager
Remote Access Connection Manager
Remote Procedure Call (RPC)
Remote Procedure Call (RPC) Locator
Remote Registry
Server
Windows Management Instrumentation
Windows Management Instrumentation Driver Extensions
WMI Performance Adapter
Workstation
[Back to top]
|