Error accessing Windows Vista Event Log

[Pushkar]

Hi,



I am trying to Windows Vista Event logs from remote machine.I am using
native Event Viewer to view all the events.
I am able to see all the events of Vista machine but unable to see the
description of each event in the log.
Reading description gives following error:


"The description for Event ID ( 1001 ) in Source (
Microsoft-Windows-Reliability-Analysis-Agent ) cannot be found. The local
computer may not have the necessary registry information or message DLL
files to display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support for
details. The following information is part of the event: 178."



Same logs give proper description when accessed on local Vista machine.



Is this change is by design? Or is it a Bug?

If it is a bug can some one please suggest me some work around to read the
logs from remote machine?



Thanks in advance.



Pushkar

 

[Jimmy Brush]

Are you trying to read the event log from another Vista computer or an XP
machine?

- JB

Vista Support FAQ
http://www.jimmah.com/vista/

 

[Pushkar]

I am trying to read from other XP/2000 machines.

Pushkar

 

[Jimmy Brush]

Ok, here's the skinny on this message, from Microsoft:

"The key to these messages is that the missing information is imbedded in
the components to which the messages are related ... the information is not
displayed because the message information is stored in the corresponding
component or application. To view the information, you have to look at the
event logs on that computer. With /auxsource, you can view the missing
information even though you are not logged on to the computer that is
experiencing the problem."

In other words, here's what you need to run from the command prompt:

mmc /a eventvwr.msc /auxsource=server

Where server is your vista machine.

NOTE: You will need to have already connected to the Vista machine and
authenticated as an administrator for this to work. The link I give you
below will show you additional ways of authenticating with the Vista
machine.

Here's the full article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;312216

- JB

Vista Support FAQ
http://www.jimmah.com/vista/

 

[Pushkar]

Thanks Jimmy for your quick response.
I tried with "mmc /a eventvwr.msc /auxsource=server"
and now I am getting following description:

"The description for Event ID ( 9004 ) in Source ( Desktop Window Manager )
cannot be found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote computer.
The following information is part of the event: 0x18."

This is I am sure not the expected message from the event, because I am
getting proper message from local machine.

Thanks,
Pushkar

 

[Pushkar]

Any update on this?
Does anyone know why this is happening?

 

[Jimmy Brush]

Sorry, I've been trying to get my Vista box to allow my XP box to access the
event viewer but I couldn't get it to work.

If you've followed all the suggestions in the KB article I posted and read
all the caveats (for example, this will not work on Windows 2000, only XP),
and it still doesn't work, I'm at a loss. Assuming there is a good reason
that this doesn't work (and that the current behavior is not a bug),
hopefully when MS releases the admin tools for longhorn server it will allow
this to work properly.

- JB

Vista Support FAQ
http://www.jimmah.com/vista/

 

[Pushkar]

Thanks Jimmy