ntevl not reading event data

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

The ntevl probe is having issues reading event data for certain events.  The example XML data below was copy/pasted from the Status tab of the ntevl probe UI.  The <Message> tag is empty, which is consistent with the errors in ntevl.log that say "Error getting message string for event DETAILS: Publisher: Prognosis Alert EventID: 0 ".  When looking at the event from Event Viewer on the actual server, there is no RendingInfo section in the XML so I'm thinking this may be something the ntevl probe adds and reads from.  CFG and LOG are attached.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>

<System>

<Provider Name='Prognosis Alert'/>

<EventID Qualifiers='8448'>0</EventID>

<Level>2</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime='2020-01-22T18:10:00.382559000Z'/>

<EventRecordID>30498728</EventRecordID>

<Channel>Application</Channel>

<Computer>PWFLxxxxxxxxT02.ad002.inxxxxps.com</Computer>

<Security/>

</System>

<EventData>

<Data>Summary Data - |Online 29| Approval:96.34 % Denial:3.65 %</Data>

</EventData>

<RenderingInfo Culture='en-US'>

<Message></Message>

<Level>Error</Level>

<Task></Task>

<Opcode></Opcode>

<Channel></Channel>

<Provider></Provider>

<Keywords>

<Keyword>Classic</Keyword>

</Keywords>

</RenderingInfo>

</Event>

Cause

- undetermined

Environment

Release : 9.2.0
Component : UIM - NTEVL
robot v7.80
ntevl v4.31

Resolution

Customer decided to migrate the alarming (alerts) over to the logmon probe and that worked successfully as a workaround.