MS Audit Collection Services

[RobertWengewicz]

So we are starting to collect the ACS's and worked with Microsoft to add a field to the query that discribes what the message ID is. I doing this I had to change one of the (FLD's) to a actual variable. Figuring this is all I needed to do thought this would be a quick job. Well I have come across 3 message ID's that are not in the XML - 4668, 5145 and 534 ; I have event source 20111004-165427 installed and Ver 4 sp 4 patch 3 installed. anyone else have any issues with ACS? Here is our query that we use also. select CreationTime,Id,A.EventId, [S/F], ED.EventDescription, SequenceNo,Category,CollectionTime, AgentMachine,EventMachine,Source,HeaderSid,HeaderUser,HeaderDomain,PrimarySid,PrimaryUser, PrimaryDomain,PrimaryLogonId,ClientSid,ClientUser,ClientDomain,ClientLogonId, TargetSid,TargetUser,TargetDomain,String01,String02,String03,String04,String05, String06,String07,String08,String09,String10,String11,String12,String13,String14, String15,String16,String17,String18,String19,String20,String21,String22 from AdtServer.dvAll AS A Join dtEventDescription AS ED ON A.EventId = ED.EventID WHERE CreationTime > '%TRACKING%'

[RobertWengewicz]

So nobody has seen a issue with the XML for MS ACS that it is missing Msg ID's?

[RSAAdmin]

The missing message id's will be addressed in an ESU. There is an official process in place to deal with such issues. To submit messages run the send_unknownmessages.cmd located in the bin directory and submit them through support. The messages will then be include in a monthly ESU.

[RSAAdmin]

We collect ACS but I'm not all sure I follow your issue. I thought I'd reply and let you know that we got burned on a regular basis with the WHERE CreationTime > '%TRACKING% part of the query. With workstations all over the planet, we do NOT want to be at the mercy of some local machine's internal clock. I changed the tracking field to CollectionTime instead and all works well now.

[RSAAdmin]

Mike,

Thanks for the suggestion.  This change was implemented and should have been delivered in the October ESU.

Regards,

Paul

[RobertWengewicz]

Well I just updated to the latest ESU and I still don't see the message ID from the original post plus these 517, 1102, 4732, 4733. I did do the Unknown msg and looked at the file and these are not in the Unknown messages log. Is it that these are really not required by most people and that is why they are not added?