locked
NPS Accounting (logging) issues RRS feed

  • Question

  • I just finished building a server which is an RDS Gateway for external access which installed NPS and all is working great except the logging. When first build the IAS logs looked normal and formatted properly. Afterwards I click on Configure Accounting, Log to Text File and chose the remaining defaults. This modified the Log Properties to DTS which was a format IAS Log Viewer (3rd party log interpreter) can't read. I changed it back to IAS (legacy) and now the logs are not formatted poperly at all. Please see the two results from before and now. Can anyone tell me how to get the logging back to example 1?

    Example 1 (Properly formatted)

    "gateway","RAS",09/19/2011,10:04:26,1,"domain\user","domain\user","UserAuthType:PW",,,,,,,,,,,,5,,,12,7,"SPTS_CAP_01",0,"311 1 fe80::9d77:be37:55a3:e40f 09/19/2011 16:56:30 1",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",1,,,,
    "gateway","RAS",09/19/2011,10:04:26,2,,"domain\user",,,,,,,,,,,,,,,,,7,"SPTS_CAP_01",0,"311 1 fe80::9d77:be37:55a3:e40f 09/19/2011 16:56:30 1",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",1,,,,
    "gateway","RAS",09/19/2011,10:04:26,4,"domain\user",,"NTLM",,,,,,,,,,,,5,,,,,,0,,,,,,1,,,,,,,,,,"{B0D4B75F-AC83-4495-8B85-3F50900DF328}",,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",,,,,
    "gateway","RAS",09/19/2011,10:04:26,4,,,,,,,,,,,,,,,5,,,,,,0,,,,,,1,,,,1,,,,,,"{B0D4B75F-AC83-4495-8B85-3F50900DF328}",,,,,"AATSPP:rdhost:3389",,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",,,,,
    "gateway","RAS",09/19/2011,10:38:04,4,,,,,,,,,,,,,,,5,,,,,,0,,,,,,2,,743240,11426115,1,,,,,,"{B0D4B75F-AC83-4495-8B85-3F50900DF328}",,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",,,,,
    "gateway","RAS",09/19/2011,10:38:04,4,,,,,,,,,,,,,,,5,,,,,,0,,,,,,2,,,,,,,,,,"{B0D4B75F-AC83-4495-8B85-3F50900DF328}",,,,,,,,,,,,,,,,,,,"TS GATEWAY AUTHORIZATION POLICY",,,,,

    Example 2 (not formatted correctly)

    ,domain\username,10/05/2011,10:56:38,RAS,gateway,6,12,30,UserAuthType:PW,8138,client_workstation.domain,8132,1,61,5,4154,TS GATEWAY AUTHORIZATION POLICY,4155,1,4129,domain\username,4130,domain\username,25,311 1 fe80::9d77:be37:55a3:e40f 09/28/2011 16:50:35 53,8129,PHSB\client_workstation$,4127,7,4149,SPTS_CAP_01,4136,1,4142,0
    ,domain\username,10/05/2011,10:56:38,RAS,gateway,25,311 1 fe80::9d77:be37:55a3:e40f 09/28/2011 16:50:35 53,8153,0,8111,0,8166,31,4154,TS GATEWAY AUTHORIZATION POLICY,4155,1,4129,domain\username,4130,domain\username,8129,domain\client_workstation$,4127,7,4149,SPTS_CAP_01,4136,2,4142,0
    ,domain\username,10/05/2011,10:56:38,RAS,gateway,40,1,30,NTLM,8138,192.168.120.47,50,{2A5677DE-4EA2-4F29-9DB0-A3458A145DD4},8132,1,61,5,4154,TS GATEWAY AUTHORIZATION POLICY,4136,4,4142,0
    ,,10/05/2011,10:56:38,RAS,gateway,44,1,40,1,66,AATSPP:rdshost.domain:3389,50,{2A5677DE-4EA2-4F29-9DB0-A3458A145DD4},8132,1,61,5,4154,TS GATEWAY AUTHORIZATION POLICY,4136,4,4142,0

     

     

     


    • Edited by mtnman1000 Wednesday, October 5, 2011 6:21 PM
    Wednesday, October 5, 2011 6:20 PM

All replies

  • Hi,

     

    Thanks for posting here.

     

    I think you were referring the “NPS Database Format Log Files” , please change to use it and see if this is what you want :

     

    Interpret NPS Database Format Log Files

    http://technet.microsoft.com/en-us/library/cc771748(WS.10).aspx

     

    for more information please refer to the links in the article below:

     

    NPS Accounting

    http://technet.microsoft.com/en-us/library/dd197475(WS.10).aspx

     

    Regards,

     

    Tiger Li

     

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact  tnmff@microsoft.com.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, October 6, 2011 3:06 AM
  • Hi,

    Please feel free to let us know if the information was helpful to you.

    Regards,

    Tiger Li

    TechNet Subscriber Support in forum
    If you have any feedback on our support, please contact  tnmff@microsoft.com.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, October 11, 2011 11:51 AM
  • I have tried changing the format and still no go. It seems to be missing the first field no matter what. This does sit behind TMG 2010.
    Tuesday, October 11, 2011 2:25 PM
  • Hi,

    Have you tried restarting the NPS service?

    -Greg

    Friday, December 23, 2011 7:51 AM
  • I know this post is faily old, but did restating NPS resolve this? Also, is this a known thing? That if you change the log format, or attributes to log, the files get balled up? I'm asking because I was trying to do some troubleshooting, in conjuntion with another issue, and i tried importing the logfile with powershell, I used (http://technet.microsoft.com/en-us/library/cc771748(v=ws.10) as my list of valid column names, but it appears that as the import goes columns shift.

    my headers var had 64 items in it, but when i manually copy the first line out of the log i note that there are only about 58 items, so i appear to be missing 6 fields.


    Jeffrey S. Patton Jeffrey S. Patton Systems Specialist, Enterprise Systems University of Kansas 1001 Sunnyside Ave. Lawrence, KS. 66045 (785) 864-0242 | http://patton-tech.com



    Jeffrey S. Patton Jeffrey S. Patton Systems Specialist, Enterprise Systems University of Kansas 1001 Sunnyside Ave. Lawrence, KS. 66045 (785) 864-0242 | http://patton-tech.com

    Wednesday, June 27, 2012 5:25 PM
  • Unfortunately no. I pretty much gave up and have not looked at it again. Sorry.
    Thursday, June 28, 2012 11:55 AM
  • That's too bad nobody was able to help you out, I figured out my issue, turns out my 2008R2 server is logging in the old format, so I was confused by what I was seeing. Oh well, I wish I could have had a solution for you.

    Jeffrey S. Patton Jeffrey S. Patton Systems Specialist, Enterprise Systems University of Kansas 1001 Sunnyside Ave. Lawrence, KS. 66045 (785) 864-0242 | http://patton-tech.com

    Thursday, June 28, 2012 1:20 PM