Log Monitoring and Notification Tools
Frequently Asked Questions
ANSWERS
Purchasing & Licensing
  1. Can I try your products before I buy?
    Yes! You can download a fully functional 30 day free trial of any of our products. Please go to the 'Download' menu to download the product you are interested in. If you wish to continue using your software after the 30 day trial period you will need to purchase a license key.
    [Back to top]
  2. How many licenses do I need?
    A single license entitles you to install our software on a single computer. You can use that installation to monitor as many logs and PC's/Servers as system and network resources allow.

    There is no need to install any software on monitored PC's/Servers.

    Please see the "Scalability, Installation, Upgrading and Backup" section of this knowledge base for more information on scalability and information to help you decide how many installations of LogMeister/EventMeister you will need.

    [Back to top]
  3. How do I purchase LogMeister products?
    All of our orders handled by our partners Share-it and Plimus, both trusted names in on-line payment processing. The quickest and easiest way to pay is by Credit or Debit card. Simply follow the 'Buy Now' or 'Purchase' links on our product pages to make your purchase.
    [Back to top]
  4. What payment options are available?
    We accept payment (via Share-it or Plimus) by:
    • Credit or debit card
    • Purchase Order
    • Cash
    • Check/Cheque
    • Wire Transfer

    [Back to top]
  5. What currencies do you accept?

    Share-it accept payment in US Dollars, Euro, Pound Sterling, Australian Dollars, Japanese Yen, Canadian Dollars, or Swiss Francs.

    There are also display currencies, which allow you to see product prices converted into additional currencies during the online order process for reference purposes.

    Plimus accept payment in virtually all currencies


    [Back to top]
  6. When do I receive my software and registration key?

    You can download your software either before or after making your payment. Please go to the 'Download' menu to download the product you are interested in. Alternatively you can click on any of the "Try Now" links on our product pages. Your software will function normally for 30 days, after which time you will need to purchase and enter a registration key.

    You will receive a temporary registration key by email as soon as your payment is accepted. This will give you an extra 20 days use of our software. We will send you a permanent registration key within 48 hours of receiving your order.

    IMPORTANT NOTE: If you've made a payment but have not received a confirmation email and registration key within 48 hours, please contact us at support@tlhouse.co.uk providing a valid return address. A delay could mean that the e-mail address given in your order form was invalid, or that our messages are being blocked by spam filters.


    [Back to top]
  7. Do you offer bulk discounts or site licenses?
    Yes. Discounts for up to five licences are displayed on our product purchase pages. For larger orders please contact us with details of your requirements and we'll inform you of the discount schemes that we can offer you.
    [Back to top]
  8. Do you offer a money back guarantee?

    Yes. If you are not entirely satisfied with our products simply let us know within 30 days and we'll issue a full refund.

    Please note that because of the charges we incur when issuing refunds we cannot extend this offer to bulk purchases (More than 5 licenses). However, we will happily provide you with an extended trial so that you can satisfy yourself that our products meet your requirements before you make your purchase.


    [Back to top]
Security Log Monitoring
  1. How do I monitor succesful logons?

    All successful logons are Event ID 528 entries in the security log*.

    The following filter (either a feed, view or notification filter) would pick up 528 entries:

    *Event ID 540 is a successful Network Logon (Windows 2000, XP, 2003 Only)

    You may wish to narrow things down a little by filtering according to logon type.

    Logon types are as follows:

    • Type 2 : Console logon - interactive from the computer console
    • Type 3 : Network logon - network mapping (net use/net view)
    • Type 4 : Batch logon - scheduler
    • Type 5 : Service logon - service uses an account
    • Type 7 : Unlock Workstation

    So for example you were only interested in attempts to logon from a console you might use the following filter:

    NOTE: These items will only appear in your event logs if auditing is turned on and you are auditing successful logons.


    [Back to top]
  2. How do I monitor failed logon attempts?

    The unsuccessful logon events are:

    • Event ID 529 : Unknown user name or bad password
    • Event ID 530 : Logon time restriction violation
    • Event ID 531 : Account disabled
    • Event ID 532 : Account expired
    • Event ID 533 : Workstation restriction - not allowed to logon at this computer
    • Event ID 534 : Inadequate rights - The user has not been granted the requested logon type at this machine.
    • Event ID 535 : Password expired
    • Event ID 536 : NetLogon service down
    • Event ID 537 : unexpected error
    • Event ID 539 : Logon Failure: Account locked out
    • Event ID 627 : NT AUTHORITYANONYMOUS is trying to change a password
    • Event ID 644 : User account Locked out

    [Back to top]
Service Component
  1. The service will not start

    If the service fails to start, the most likely cause is a logon error (1069). This typically arises for two reasons:

    1) The password entered for the service installation account was incorrect, or has been changed subsequently. In this case either re-install your LogMeister product and enter the correct password, or manually change the password for the service via the Services control panel.

    OR

    2) The account used for the installation does not have a password. Some versions of Windows allow a service to be installed to an account that has no password, others (e.g. XP) do not. In this case, please create a password for the account in question, then either re-install your LogMeister product or manually set the password for the service via the Services control panel.

    One other reason for a logon failure when starting the service on a Windows 2000 computer is a lack of the "Log on as service" right. The installer attempts to grant this right automatically using the NTRights utility, but one user has reported that it was still necessary to add this right manually using the local security policy editor.

    If you're sure that you've set the correct account name and password but the service is still giving a logon error, open the security policy editor (type secpol.msc into the Run box) and make sure the account has the "Log on as service" right.


    [Back to top]
  2. The service is running but the application claims that it isn't
    A This typically occurs if the service was started after the application. Please quit the application, verify that the service is running in the Windows Service Manager then restart the application.
    [Back to top]
Scalability, Installation, Upgrading & Backup
  1. How do I backup settings and data?

    The bulk of LogMeister's** settings are stored in a sub-directory of the "Application Data" folder that is specific to the account under which LogMeister runs, e.g.

    C:Documents and Settings<>Application DataTechnology LighthouseLogMeister

    A fast way to get there on XP/2K/2003 is to type %appdata% into the Run box off the Start menu, and navigate down through "Technology LighthouseLogMeister"

    1. Quit LogMeister so that it doesn't change any data during backup
    2. Take a backup of the entire LogMeister directory.

    **The procedure for backing up EventMeister, TextMeister or ICFMeister are the same - just use the relevant application name in place of LogMeister


    [Back to top]
  2. How do I upgrade to the latest version?
    When upgrading there is no need to uninstall the existing version. It is advisable however to quit the existing application and stop the service component (if in use), and take a backup of your feed and notification definitions (See "How do I backup settings and data?" above).
    [Back to top]
  3. How do I transfer my installation to another computer?

    If you wish to move your installation to another computer you can simply take a backup of your existing data files folder (see "How do I backup settings and data?" above) and overwrite the corresponding directory on the target machine. This will only transfer feed and notification settings and data. You will need to manually re-enter configuration options such as email settings, startup options, etc.

    1. Quit your existing installation so that it doesn't change any data during transfer
    2. Take a backup of the entire LogMeister (or EventMeister/TextMeister/ICFMeister) directory (keep a second copy of this just in case!).
    3. Overwrite the corresponding directory on the target computer.
    4. Install the application on the target computer.

    Your fresh installation should now have all of your existing feed and notification settings.


    [Back to top]
  4. Can I upgrade from EventMeister/TextMeister/ICFMeister to LogMeister without loosing settings and data?

    If you wish to upgrade to LogMeister from EventMeister, TextMeister or ICFMeister but retain your existing settings you simply need to rename your application data folder to "LogMeister" before installing LogMeister. This will only transfer feed and notification settings and data. You will need to manually re-enter configuration options such as email settings, startup options, etc.

    1. Quit your existing EventMeister/TextMeister/ICFMeister installation so that it doesn't change any data during transfer
    2. Take a backup of the entire EventMeister/TextMeister/ICFMeister directory (see 'backing up data' above).
    3. Rename the EventMeister/TextMeister/ICFMeister directory to LogMeister
    4. Install LogMeister

    Your fresh LogMeister installation should now have all of your EventMeister/TextMeister/ICFMeister feed and notification settings.


    [Back to top]
Filter / Notification Rules - monitoring specific items in logs
  1. How do I display all Errors and Warnings but exclude everything else?
    There are two ways that you can do this:

    • Create 2 filter rules as follows:



      Be sure to select an 'OR' operator to join the two rules!

      OR

    • Create a single filter rule as follows:



      Be sure to check the 'treat as regular expression' checkbox when you define the constraint!

    [Back to top]
  2. How do I display all 101 and 102 errors that occur in a specific date range?

    There are two ways that you can do this:

    • Create two filter rules as follows:



      When defining the constraints, be sure to check the "Treat as regular expression" for the first rule, and select "In Date/Time Range" for the second.

      OR

    • Create three filter rules as follows:



      The two rules pertaining to the Event ID should be joined by an 'OR' operator and grouped. (Just select the two rules then click on the 'Group' button).

      Be sure to select the "IN Date/Time Range" option when defining the constraint for the Date rule.

      Select an 'AND' operator between the grouped Event ID rules and the Date rule.

    [Back to top]
Feeds - Monitoring Logs
  1. Our software writes to a log file but every hour/day the log file name change how can I monitor such a log?
    If a log is distributed across one or more files, you can tell LogMeister how to recognize the logs. You can either specify the names of all the logs that are to be used, or you can enter a file spec and/or regular expression that will match the necessary file names.

    For example:

    If you wanted to match the files mylog1.txt, mylog2.txt.....mylog9.txt:

    '*.*' entered into the 'Spec' text box would match mylog1.txt, mylog2.txt, and so on, but also someotherfile.exe and someothertextfile.txt

    'mylog*.txt' would match mylog1.txt, mylog2.txt, and so on, but also mylog99.txt.

    You can further refine file selection by entering a regular expression in the 'Filter by regular expression' text box.

    For example:

    'mylog[1-9]\.txt' would limit both of the above file specifications to match only files in the range mylog1.txt to mylog9.txt

    You will be given the opportunity to do this on the first page of the Text Log Feed Wizard - just check the 'Other Files' box and enter your filenames or your regular expression in the boxes provided.

    LogMeister will only process the files that have been modified since the last polling period. The time taken to check whether a file has been modified is negligible, so in your situation LogMeister will effectively monitor the most recent log only.


    [Back to top]
Trouble Shooting
  1. I can't read Event Logs through the Windows XP Firewall

    As you probably know already, XP service pack 2 (SP2) includes an improved version of the Windows Firewall which is now enabled by default.

    In its default configuration, the Windows Firewall prevents access to event logs from across the network. This will typically be reported by LogMeister/EventMeister as "access denied".

    In order to restore access, you'll have to configure the firewall on your XP SP2 computers to allow remote administration (aka WMI).

    The simplest way to do this is to open up a command prompt and type the following:

    netsh firewall set service RemoteAdmin

    The effect is immediate - no need to restart.

    To read more about this, consult the following Microsoft article:

    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/connecting_through_windows_firewall.asp


    [Back to top]
  2. I'm getting an Access Denied Error - why?

    Both EventMeister and LogMeister use a Microsoft technology known as WMI to access the logs on your networked computers. The most common error reported by the operating system for WMI problems is Access Denied. As you might have guessed, there are many causes for Access Denied. Here's a quick run down of some of the more common ones. You'll find a longer list, with more suggested solutions, in the Troubleshooting section of the Help.

    1. If reading logs from another computer on the network, make sure that the user and password you have supplied for each feed correspond to an administrator account on the target computer. That account MUST have a non-blank password.
    2. Check that DCOM is enabled on both the host and the target PC. Check the following registry value on both computers:
      Key: HKLMSoftwareMicrosoftOLE, value: EnableDCOM, should be set to 'Y'
    3. Check that WMI is installed. WMI is present by default in all flavors of Windows 2000 and later operating systems, but must be installed manually on NT4 systems.

      To check for the presence of WMI, type "wbemtest" into the Run box (Start Menu). If the WMI Tester application starts up, then WMI is present, if not, it must be installed. Consult the Troubleshooting section of the Help for details.
    4. Ensure that WMI permissions have been set correctly. Please consult the Troubleshooting section of the Help for details.
    5. On a Windows XP Pro computer, make sure that remote logons are not being coerced to the GUEST account (aka "ForceGuest", which is enabled by default computers that are not attached to a domain). To do this, open the Local Security Policy editor (e.g. by typing 'secpol.msc' into the Run box, without quotes). Expand the "Local Policies" node and select "Security Options". Now scroll down to the setting titled "Network access: Sharing and security model for local accounts". If this is set to "Guest only", change it to "Classic" and restart your computer.
    6. Also on an XP computer running SP2, configure the firewall to allow remote administration. To do this, open a command prompt and type: netsh firewall set service RemoteAdmin
    7. If you have other internal firewalls on your network, you may have to configure them to allow WMI messages. Again, you'll find advice on how to do this in the troubleshooting section of the Help.

      Even if you are not knowingly running any firewall software, bear in mind that big-name antivirus solutions such as those produced by McAfee and Symantec often contain their own firewall functionality. If such software is not properly configured to allow WMI traffic, then this may be the cause of the problem.
    8. Make sure that no remote access or WMI-related services have been disabled. On an XP machine, the following services should be running (or at least allowed to start on demand):

      COM+ Event System
      Remote Access Auto Connection Manager
      Remote Access Connection Manager
      Remote Procedure Call (RPC)
      Remote Procedure Call (RPC) Locator
      Remote Registry
      Server
      Windows Management Instrumentation
      Windows Management Instrumentation Driver Extensions
      WMI Performance Adapter
      Workstation

    [Back to top]
Jump to: