locked
Windows 2008 R2 Event Collector Server - Subscription Issues RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

    I have set up and Event Collector server nad created a subscription for collecting critical events. It is working except for one thing. The Collector server doesn't display the event. I get the following message with all events forwarded to it:

    How do I save the display information with the event?
    ___________________________
    The description for Event ID 602 from source Microsoft-Windows-PrintService cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

    If the event originated on another computer, the display information had to be saved with the event.

    The following information was included with the event:

    The locale specific resource for the desired message is not present
    _______________________________

    Wednesday, March 17, 2010 5:02 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    I have exactly the same issue, and i have no clue why this is happening. I have four DCs (two writeables, two RODCs), all running the english version of Server 2008 R2 Standard, and all of them have the same system locale. One box collects all Warnings and Errors from the three others. The events get forwarded, but they don't display properly - same issue as afex'.

    I've even set up an event subscription to the localhost of the event collector, so the collector forwards it's own events to itsself. Even those "lose" their system locale on the "way".

    the event collector is a great idea, but it's kinda useless like this. any ideas on how to fix this?

    Thursday, April 15, 2010 6:57 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I had the same problem and made 2 changes that seemed to fix it, both are based on an article by Otto Helweg here .

    First in an Administrator command prompt run "wecutil ss <subscriptionName> /cf:Events" to change the ContentFormat, this is the most likely fix.

    If you are still having problems then add “Network Service” to the “Event Log Readers” Local Security Group, or if collector is a DC you will need to add it to the Domain “Event Log Readers” Group in Builtin OU.

     

    Monday, May 17, 2010 5:40 AM