RSA Admin

Event normalization failure Reason= XML parsing errors

Discussion created by RSA Admin Employee on May 25, 2015

Hi,

 

Recently we have an issue with windows 2008 R2 server as it stopped sending logs, upon debugging with wineventsvc we observed

%NIC-4-1001014: WINEVENT, Normalization, -, -, -, -, Details: Event normalization failure: Reason=[192.168.1.157] XML parsing errors.

Tried raising bookmarks for few hundred events with wineventbookmark.exe but received below error "Can not set record number to "323019" for Security channel".

Any help is appreciated.

 

Thanks

Ramesh

Outcomes