Hello all, I'm using the trial version of log and event manager, but I seem to have a significant issue setting up rules. Currently I have the log and event manager agent setup on 1 node and linked to my domain controller. I can view reports just fine, for instance I can use ndepth to view the logs of a machine, view running processes, etc. The problem comes from when I attempt to setup rules, for example to test out rules what I attempted to do was have LEM detect the mspaint process was running, then popup a message just saying test. when I monitor the rule, when I go to monitor and check rules activity no rules have fired. I have turned the rule on pressed activate rules before testing, and the rules is not in test mode. When I check ndepth after this it does pickup the process was running and the time is correct on the execute, the rule just fails to execute for some reason. I have tried a number of different rule setups with the same result, I have even wiped the virtual appliance and started over. Any ideas?
↧