SB EventLog Monitor is powered by AnyChart - Flash Charting Solutions.

A new version of the EventLogMonitor Agent is available for download.

The biggest change is that the Agent now supports NT4 workstations and servers. Pre-install requirements for NT4 are that both Service Pack 6 and Internet Explorer 4 (with the Active Desktop Update) or above are installed on the target computers. There continues to be no special pre-requisites for Windows 2000 and above.

Please ensure you have the updated version of the rpc.php file mentioned in the last news post (http://sourceforge.net/forum/forum.php?forum_id=720486) otherwise no events will be reported to the server.

Note that due to NT4 support, the configuration file stored on the netlogon share is now accessed with the currently logged on users' permissions instead of the agents own. This means configuration will not take place until a user with sufficient rights to read from the netlogon share logs on to the machine. The agent will continue to collect events in online mode, but no sending will take place until configuration is successful.

Other improvements include:
Condition where timed mode would not be entered fixed.
Resource leak in XML posting fixed
Uninstallation now removes the EventLogMonitor folder
Number of temporary log files created reduced (0 comments)

If You have problems with receiving events from Windows Agent, please update SB ELM to latest revision from SVN repository... The SVN revision 39 should fix this issue.
If You don't want or can't use SVN, You can download just the modified version of RPC.php from this link: http://eventlogmonitor.svn.sourceforge.net/viewvc/*checkout*/eventlogmonitor/trunk/htdocs/rpc.php

Please... keep backup of Your current RPC.php - there can be compatibility problems. Also You have to update MySQL schema for table "sbevtlog_secrets".

Current table schema:

CREATE TABLE sbevtlog_secrets (
ip_addr char(32) NOT NULL default '',
hostname char(255) default NULL,
agent_version char(16) default NULL,
secret char(15) NOT NULL default '',
secret_expire datetime NOT NULL default '0000-00-00 00:00:00',
PRIMARY KEY (ip_addr),
KEY key_expire (secret_expire)
); (0 comments)

changelog:
Support for reporting only certain types of event instead of all types
Added workaround for FormatMessage crash
Improved error handling in constructors
Events now reported if Agent can't start or open required registry keys
Removed coupling between LogManager and EventLogMon classes (0 comments)

changelog:
Exception information is now logged to the Application event log rather than a file
GetOsVersion now reports 64-bit OSes
Free functions now moved to separate file
Casts changed to C++ syntax
Removed fixed length buffer from Message::FormatFullMessage
Removed unnecessary static stringstreams as the memory leak bug in MSVC2005 has been fixed
Sid retrieval now in a class
Added define in main.cpp to allow toggling between service and application startup for debugging purposes
Added port detection and did some cleanup on the config tool (0 comments)

This release is only available in SVN...
SB EventLog Monitor version 0.76 has been released. There is one IMPORTANT function in this version - "MySQL table schema Auto Update" - SB ELM will update MySQL tables without Your interaction, so this will make updating more easy ;)
Also, this release is pre-beta3... So the next release (probably 0.80 beta3) should be here soon.

full change log:
0.76
* added MySQL table schema AutoUpdater - all MySQL tables will be updated automaticly since this version
* few tweaks of user interface
* added "reload" button (into "auto refresh" selection box
* updated help (only English)
* updated "WMI-EVENTS.vbs" collector

0.75
!!! MySQL table change !!! (_sbeventlogmonitor_beta2__075.sql)
* heavy tweaks og MySQL indexes for much better performance
* added AutoComplete also to "EventLog" and "Alerts" page (filters)
* tweaked AutoComplete
* added Donors to the About page (using RSS)
* added Domain to the "Monitored computers" page (only information - domain don't have any effect)
* updated SMARTY class
* updated WMI-EVENTS.vbs (added logging, ...)
* updated CONFIG->MONITORED COMPUTERS page - added Computer Group filter
* Reporting - more graphs - not finished yet! (0 comments)

Updated version of Windows agent has been released.

change log:
* service should be a little bit faster
* fixed few small bugs
* config tool was updated (automatically put the IP of the machine into the "Server IP" field) (0 comments)

There are some "speed" related problems. It is caused by "badly" designed MySQL indexes.
This issue will be addressed in next release. If You have problems with slow access to the summary page after login, You can apply the "hotfix". More information about this can be found in this discussion: http://sourceforge.net/forum/forum.php?thread_id=1694787&forum_id=639781

The final MySQL "fixing:" query is here: http://sourceforge.net/forum/message.php?msg_id=4212467

BTW: Apply only on Your own risk! (these MySQL queries will only drop old indexes and will create new ones). (0 comments)

Version 0.74 is out ;)
Most important is patch for the "1664214: Error accessing web page" bug (affecting only instalations with disabled user access control).
There are two new requested features and one non-requested feature...
Every computer can be member of more than one group :D Also, when You rename or delete group, this will be reflected to "Alert filters" rules.

The second new feature... You will be able to see computer description on "Monitored computers" page (description is updated automatically from monitored machines).
note: If You are using EventLogMonitor agent, You must update it to version 1.01. If You don't do this, You won't see be able to get "computer description". All other thinks, WILL work.

And the best one:D I have added "Auto Complete" feature to the Alert filters Rule editor... so when You will start typing, You should see "suggested" values (taken from all collected events) - You must see this :D

Also several components was updated and there are few small bugs fixed.


Changelog:
0.74
!!! MySQL table change !!! (_sbeventlogmonitor_beta2__074.sql)
* Bug 1664214: Error accessing web page
* updated the SWFObject library to version 1.5
* Feature 1664672: 1 computer in more than 1 Computer group
* fixed bug when showing group with no computers in it
* when you update or delete computer group, FILTER RULES are also updated!
* fixed few small bugs in RPC.PHP script
* Feature 1664988: Friendly Server Names
* intelligent AutoComplete in Rule creation (Filter rules) (0 comments)

Updated EventLogMonitor agent has been released. This updated is needed to use all functionality with SB ELM 0.74 (will be released soon).

You can use this version with any older version of SB ELM. This version is backward compatible ;) Also You can use older agent with newer SB ELM (but You will loose new functionality).

===UPDATING===
* You must uninstall older version of ELM agent before installing this new one
* if You are NOT using NETLOGON share to configure agent, You must import configuration to the registry again (from REG file)!

This release contain BINARY version (MSI installer) and full source code.

===Change log===
1.01
* support for computer friendly names
* support for computer domain (0 comments)

As was reported in BUG report "[1664214] Error accessing web page" there is one small bug in version 0.73.

Due to change in User Access Control, when You disable integrated UserAuth, You won't be able to access SB ELM. FULL FIX will be included in next release.

For now, You can apply hotfix on Your own...

1. open INDEX.PHP for editing
2. find this line $template_file = $_GET["module"] . ".tpl";
3. add this one line before the line above: if (empty($_GET["module"]))
$_GET["module"] = "showSummary";
4. save INDEX.PHP
5. fixed.

Please apply this ONLY when You can't access SB ELM version 0.73. If You do not have any problems, DO NOT APPLY THIS HOTFIX.
I will release fixed version later today after better fixing (this fix can cause problems when using UserAuth). (0 comments)