I am trying to use resource event occurs from a Microsoft tutorial. I know how to detect if a subscription is deleted or created. I cant find a way to detect if a virtual machine i am using restarts
We have a document that explains the different kinds of reboots. In that doc you will find a link to the Activity Logs which you can use to find when a VM reboots among other actions
https://learn.microsoft.com/en-us/azure/virtual-machines/troubleshooting/understand-vm-reboot
https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-logs-overview
Related
I am currently running ossec 3.6 in local mode and forwarding data to Splunk. I cannot seem to find something similar in wazuh - am I missing something? We really don't want to have a manager as all our data goes to Splunk anyway. We'd like to continue outputting ossec/wazuh data in Splunk format and send straight to Splunk. I've Googled and read the wazuh docs, but cannot find anything that addresses this. Is this possible?
Currently, there is no way to use standalone agents in Wazuh.
However, Wazuh managers also act as an standalone agent. Therefore, if the system you want to monitor is Linux, you can directly install the Wazuh-manager package there and it will take care of collecting and analyzing its local logs. Take a look at this doc, in case it helps Migrating OSSEC server.
If your target version is different from Linux (Windows, macOS, etc), there is no alternative and you will have to install a Wazuh-manager on a linux instance that the agent can report to. Agents without a manager cannot do anything.
I hope this solves your question!
Enviornment :
DCOS : 1.7 running on vagrant
There are many reasons this could fail, but you did not provide enough information to narrow it down. However, the most common problem observed when getting started is missing the bit about having a private vs public agent available and the role being specified in the app json. I can't tell from the single screen shot what environment you are running or the json for the apps you were trying to run. If you are really stuck, try visiting https://dcos.io/docs/1.7/administration/installing/custom/troubleshooting/ and check out their slack channel for assistance. https://dcos-community.slack.com/
I got the same problem when installing DCOS form the Azure template, when I logged in, it appeared that I had 0 nodes connected in my cluster (which is obviously not good). I reinstalled it from another template and it fixed my problem. Hope it helps.
We use some virtual machines at work for testing. For example, if someone reports some weird bug that only happens on a specific OS we can just fire up the machine and debug it. Problem is that we may be outsourcing part of our testing workflow and we were discussing if it is legal or not to have Windows VM images available for third party download.
I would think that if we just set them and then remove the Key it is fine, but I cannot find somewhere were this is written explicitly. Has anybody had any problem like this before?
I have problem printing reports to PDF through bullzip from Navision Application Server (1) if user is not in Local Admin group (2). Only under both conditions.
In Nav code I'm doing the following: init bullzip automation object (set all parameters to suppress GUI), run report to print document to virtual bullzip printer, catch output file. Thats it. Straight as a rail.
I have two environments: Windows Server 2008 and Windows 7 (different versions of Nav, but this is changing nothing). On Windows 7 it just do nothing (but works if user is admin). On server I can see error in Event Log (translated to English)
Faulting application gui.exe, version 9.8.0.1599, time stamp 0x517126dc, faulting module USER32.dll, version 6.0.6002.18541, time stamp 0x4ec3e39f, exception code 0xc0000142, fault offset 0x0006f52f, the process ID 0x3bc, application start time 0x01ce562238369fa9.
Gui.exe is a part of bullzip.
If I run the same code from Nav Classic Client, or from the same NAS launched in command line, or under local administrator account, or if i put the NAS user in local admin group - it works just fine.
To solve this problem i need to find out one of two and how to fix it:
What is the difference between local admin and regular user that could cause application to crash in non-interactive mode (service) under regular user account.
What is the difference in running NAS as service and as command line that could cause application to crash when run as service.
What I've tried so far: extend non-interactive desktop heap, give user all local privileges that admin have in gpedit. Not works. Don't know direction for further digging.
Any alternative free pdf printers advices are welcome.
This question is still actual. Though I've managed to setup PDF printing with PDFCreator. The tough part was to let several different NAS to print simultaneously. And now the setup have a bottleneck - PDFCreator's printing queue. With bullzip automations it could be avoided.
We've had some cases where third party DLL's have crashed within NAV due to permission restrictions.
The only effective way we could narrow down the files that it was trying to access was through using Process Monitor to try narrow down what was causing permission issues.
We found a folder within System32 to do with the System's Network Profile that some DLLs use. On that note, NAS's and such should be run under a domain account.
I think re-installing the application will do that,
Just make sure you are uninstalling each bullzip and ghost script,
Now Ghost script is tricky thing, if you are installing 32 bit over 64 then you are having problem,
refer this download link download appropriate version, install it,
and then install bullzip, after downloading new version from here
this will do..
then also if any problem(if you are using application for automation, you require new com object..) refer Forum, that explains most of application interface problems..
where you need to use public class PdfSettings with namespace bioPdf.
I hope this will help ..
I want to keep a log with the attempted log-in to a machine. The OS is Windows Embbeded Standard. Is it possible to make Windows execute an application or a script after every login attempt to enable me to save that information in my database?
EDIT:
Extract from Superuser:
"Here, you can set auditing to all types of events. I believe the one you want is "Audit logon events", Set it to Failure (or Success as well if you want).
All events will now get sent to Event Viewer. ..."
Is it possible to access the Event Viewer info via WMI?
From a security viewpoint, I would assume this would not be possible. But it is possible to write your specialized GINA library which would replace the standard login system of Windows. This was done to support fingerprint readers and smart card readers, and many other alternative login methods.
But out of curiosity, what kind of problem are you trying to solve here? Windows already has plenty of build-in functionality which can be analysed by anyone who can log in.
Follow this link to see how it's done in Windows 2003. I've checked with Windows XP on a virtual machine and it works exactly the same there. So I assume it also works in embedded XP versions.For reading the event log, this link from MSDN will be practical too. This will require .NET though, which is optional on Windows XP.
WMI might be a good place to start. You could use WMI (or another method) to query the security event log for sucessful/failed logon events, too.
http://www.computerperformance.co.uk/vbscript/wmi_event_log_administrator.htm