Any news on this? I am seeing something similar on our DC audit events, eventID 4662. I have started to notice some issues with events coming in from the LIAgent in the last few days. The events...
See more...
Any news on this? I am seeing something similar on our DC audit events, eventID 4662. I have started to notice some issues with events coming in from the LIAgent in the last few days. The events are no longer showing content, just a "-" or random sting of numbers. The events do have valid source host names, event IDs etc but the body of the event has stopped displaying correctly. I have confirmed that the events are correct within the eventlog on the source host. In our case, the body of the message exists, but some client side parsing is missing. Such as, "Object Type" and "Object Name" are GUIDS as opposed to their actual directory object names. I am comparing the event in LI and the actual event in Event Viewer. Using Liagent 2.5.0.2347850 and the api to send events. [EDIT] It's not just the 4662 eventID that we are noticing, but also failing to send the parsed SID in event 4732 as the actual name/data.