search cancel

Viewing Symantec Information Centric Tagging events using Windows Event Viewer

book

Article ID: 173242

calendar_today

Updated On:

Products

Information Centric Tagging

Issue/Introduction

Symantec Information Centric Tagging (ICT) creates events that can be viewed by Windows Event Viewer. To view the ICT events data on a computer that does not have ICT installed, perform the following steps. 

Resolution

Install Information Centric Tagging Event Parser

  1. Copy rw-eventlogmessages.dll to a location that is always accessible by the operating system:
    • For x86-bit systems: x86\rw-eventlogmessages.dll 
    • For x64-bit systems: X64\rw-eventlogmessages.dll 
  2. Create the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\ Application\ Information Centric Tagging 
  3. On this registry key, create the following registry values:

Value name

Value Type

Value data

CategoryCount

REG_DWORD

0x00000003

CategoryMessageFile

REG_SZ

Full path of rw-eventlogmessages.dll Eg.: C:\filter\rw-eventlogmessages.dll

TypesSupported

REG_DWORD

0x00000007

EventMessageFile

REG_SZ

Full path of rw-eventlogmessages.dll Eg.: C:\filter\rw-eventlogmessages.dll

  1. Restart Event Viewer.