EventCombMT

EventCombMT is a multi-threaded tool that will parse event logs from many servers at the same time.

It allows you to specify any or all of these criteria:

  • Individual Event IDs
  • Multiple Event IDs
  • A range of Event IDs
  • An Event Source
  • Event Text
  • How many minutes/hours/days back to scan

Features:

  • Multithreaded for very fast performance! Every server gets its own thread.
  • SIDs are cached for faster searching of security logs.
  • Flexible Searching parameters
  • 6 ways to add servers to search
  • Built in Searches (Account Lockout and Several FRS searches)
  • Adjustable Thread count to control bandwidth
  • DLL Caching
  • Save and load searched

Potential Uses:

  • Find the last time all your servers rebooted
  • Track down account lockouts
  • Troubleshoot FRS issues
  • Determine DC Health (look for problems before they become serious)


Domain: Text box that lists the domain you are in, and where the DCs will come from when the list is populated.

Servers/Logs: Select the servers/logs you would like to search.

Right click in this window do add servers.

Use File\Open Saved Logs to add Saved Event Logs to this list.

Output Directory: Default is c:\temp and it will be created if it doesn’t exist. Choose Set Output directory from the File menu to change this. This setting should be remembered between sessions.

Specific IDs: Enter the specific IDs you wish to search for. Enter IDs separated by

spaces, up to 10 events may be entered.

Source: The source is pulled from the registry. It is only available if exactly one

log is selected.

Text: Enter the text that must be in the event to capture it. Do not use logic (and, or), or

quotes. It is case insensitive.

Scan Back: Allows you to choose how far back in the logs to search. Enter a number in the text box and then choose: Minutes, Hours, or Days. Once this criteria is reached the log is abandoned.

Default: Days

Status: Lists information pertaining to the current search. This information is also saved to the file EventCombMT.txt file.

Choose Log File to Search:

Allows you to select which log files to search.

Available logs files are:

    • Directory Service
    • Application
    • File Replication Service
    • System
    • DNS
    • Security

NOTE: Logs will be disabled if you do not have the capability to open them normally. You may be able to edit the registry to enable parsing of disabled logs.

Event Types: Allows you to choose which types of events you would like to search.

You can choose from:

Error

Informational

Warning

Success Audit

Failure Audit

Success (very rare. Event Viewer shows these as Informational.)

Get All Events Matching Above Criteria: Checking this box short-circuits any other search criteria. For instance, if you check Warning and Application, you will capture all Warning events in the Application log. This will also disable all search criteria since it will not be used. This applies even if data was previously enter in the criteria boxes and is visible. If the criteria controls are disabled they will not count towards the search.

Threads: Use this slider to control how many threads are running. It is active even when a search is running.

Default: 25 threads

NOTE: If there are 50 threads running and you slide it to 40, there will still be 50 threads running, it doesn’t pause or kill running threads. However, no new threads will be spun until the count drops to 39.

Servers Running: Displays a list of the servers whose searches are running now.

Statistics:

Total Records searched: The number of events that have been examined.

Matching Events Found Total: The number of events that have matched the

search criteria.

Records per seconds: The average number of records per seconds that were parsed (saved or discarded.)

Threads Running: The number of currently running threads. The name of each thread is also shown.

Total Bytes Read: The number of bytes reads. As the number grows, it will switch

to Mbytes and then GBytes.

Cached DLLS: The number of DLLs in the cache. This number is usually low,

less than 50 for a large search, and is limited to 500, currently. If your search is specific (6005, Informational, System log) then this counter may stay at 1. DLLs are only loaded after all other search criteria have fired (except text.)

The name of each DLL is also shown.

Cached SIDs. SID to name lookups are very slow. These are cached so that if they are found again the

search runs much quicker. This is especially useful for searching security logs, where every record has a

SID attached to it.

The SIDs cached are shown in the list, this can be disabled under the options menu.

Completed: Progress bar that show the percentage of servers finished. The progress bar is updated when the search has completed. The progress bar does not indicate the progress of a log file, only the server. If you are searching 5 log files per server, all 5 log files must complete before registering.

Search: Starts the search. If you are missing some criteria you will be asked to correct it.

Quit:

When searching: Quits the search. It may take several minutes for all the threads to exit.


File

Launch Event Viewer

Opens the Event Viewer MMC

Open Log Directory

Opens the currently specified output directory in explorer. When a search is completed it opens automatically.

Set Output Directory

Sets the output directory. By default it is c:\temp. If the directory doesn't exist it will be created. Previous path is saved.

Open Saved Logs

Allows you to perform all actions on a saved event log files.

Enter the path to your saved logs in the dialog box, you can also browse for a path. Previous path is saved

Exit

Exits the application


Options

Resolve SIDS
Enables or disables the resolution of SIDS. This can be disabled to help speed up searches.
Default: Enabled

Auto Fail Unavailable Servers
Skips servers that are unreachable, for instance, they could be off line, need alternate credentials, or lacking a specific right (security logs.) If you are searching log files, they could be corrupt.
Default: Enabled

Cache DLLs
At least one DLL must be loaded with LoadLibrary for EACH event log that needs to get parsed. Instead of unloading each one after I am done, I save the address and unload them at the end of the search. This could be disabled to reduce memory utilization.
Default: Enabled

Only Get One Matching Event
This option was added to allow you to easily determine the last time your servers rebooted.
It could also be used to quickly determine if your servers are encountering severe problems that require immediate attention and you don’t want to wait for a detailed search to finish. Examples might be, Drive Array Errors, DS Corruption Errors.
Default: Disabled

Throttle CPU
Slows the application down. This can be used to reduce the network bandwidth that is used.

Popup Warnings for Full Event Logs
If an event log is full, your searches might not find the events you are looking for, depending on the options you selected, then could have been overwritten, or never logged. This option alerts you to that.
Default: Enabled

Notify if Criteria Found
If an event is found and written to a log a dialog box is shown containing the information.
This option is primarily meant for errors that you do not expect to find but would be critical if they were.
Only one popup will be displayed per server per log file.

Capture Event ID Statistics
Keep track of how many times an event is found in the log. This information is put at the end of the log file.
Example:
Event ID Statistical Analysis
==============================

Event ID 538 appeared 2150 times - 31.93 percent
Event ID 515 appeared 1170 times - 17.37 percent
Event ID 540 appeared 790 times - 11.73 percent
Event ID 560 appeared 419 times - 6.22 percent
<SNIP>
Event ID 621 appeared 2 times - 0.03 percent
Event ID 566 appeared 2 times - 0.03 percent
Event ID 517 appeared 2 times - 0.03 percent

Data

Data formatting requires much more memory and space than the raw data. For instance a Dr. Watson record that is 120k, will be almost 650k when formatted.

Print Data As Words
This is a optional portion of an event record. If it exists it will be printed in this form: 0000: c0020017
If the data contains an error code, Word form is probably more useful, as in this example.

Print Data As Bytes
This is a optional portion of an event record. If it exists it will be printed in this form: 0000: 17 00 02 c0 ...À


Built In Searches

    • FRS
      • D2/D4 Check

1. Gets All DCs

2. Selects all DCs for searching

3. Selects the FRS Log

4. Selects Error and Warning Events

5. Sets the Specific IDs to 13520 13560 13561 13514

      • Staging Area Full

6. Gets All DCs

7. Selects all DCs for searching

8. Selects the FRS Log

9. Selects Warning Events

10. Sets the Specific IDs to 13522

      • FRS Health (Share,'8 &'9, DNS, ServerReference)

1. Gets All DCs

2. Selects all DCs for searching

3. Selects the FRS Log

4. Selects Warning Events

5. Sets the Specific IDs to 13508 and 13509

This search also displays and additional dialog box:

<<TO DO GET SCREENSHOT>>

On this dialog box you can choose which FRS tests to run, the first test is always run. (The slider)

The first test (slider) is always run with this test, it attempts to match 13508s and 13509s, and display and error in the log file if the time difference is more than the number of minute you chose.

Default is 60 minutes (one hour.)

Test Failed Servers for Connectivity, SYSVOL and NETLOGON

Calls NetShareEnum and enters into the log if the SYSVOL and

NETLOGON share were found.

Default: Enabled

Test Failed Servers DNS A Record

Connects to your default DNS server (bypassing the cache) and prints the

returned address in the log.

Default: Enabled

Test Failed Servers for ServerReference

Connects to the PDC and displays its ServerReference attribute for the

failing server, flags an error if the SR attrib doesn’t contain the ServerName.

Also displays the SR attrib from the server having trouble connecting, and

compares it to the SR attrib on the PDC. Flags an error if they do

not match.

Default: Enabled

Test Failed Servers for RPC connectivity (and Get Polling Intervals)

Connects to the FRS RPC service listed as having not replicated. This

verifies name resolution, connectivity, RPC health, and FRS

service status on the remote machine. If successful displays the

Polling Intervals from the remote server.

Default: Enabled

Provide Verbose FRS information on each Domain Controller (50k of text)

Dumps lots of data on each FRS config on each machine. Click here to see an example.

After choosing RFS health tests, the following dialog is displayed.

All other searches write to an individual log file, however the FRS Health write to a

single file which must be coordinated. The threads must wait for this resource and that can cause the application to appear hung. This is complicated by the fact that some of the calls made by these tests take a long time to fail if the server is unavailable. In particular are NetShareEnum and The RPC binding calls. RPC takes up to a minute (or more) to fail if the server is not available.

The status list box will display the following information when trying these tests so that you can tell it isn’t hung.

  • Calling NetShareEnum for <DC>. Please wait... or
  • Connecting to the FRS RPC service for <DC>. Please wait...

The FRS report is saved to a file called: FRS_Health_Analysis.txt in the logs directory. Click here to see an example file along with explanation.


Account Lockouts

Populates search criteria based on normal canned searches:

1. Gets All DCs

2. Selects all DCs for searching

3. Selects the Security Log

4. Selects Success and Failure Audits.

5. Sets the Specific IDs to 529 539 644