Troubleshooting
Problem
The NT Event log probe service starts and runs for a few minutes, but then stops with an application error.
Symptom
Application error pop-up:
Instruction at 0x7c84afb2 referenced memory at 0x00000014. The memory could not be written.
The NT Event Log probe log file shows the error -
Error: E-UNK-000-000: Host - \\hostname -> RegOpenKeyEx failed :
Cause
The probe user does not have sufficient permissions
Resolving The Problem
When the probe is installed as a service, by default it is installed as LocalSystem. The LocalSystem user may not have permissions to read or view the event log. If this is the case, the service should be changed to run as a user which has permissions to read the event log of all servers it is configured to monitor.
[{"Product":{"code":"SSSHTQ","label":"Tivoli Netcool\/OMNIbus"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Multi-Headed NT EventLog - for additional logs","Platform":[{"code":"PF033","label":"Windows"}],"Version":"7.4.0;7.3.1;7.3.0;8.1.0","Edition":"All Editions","Line of Business":{"code":"LOB45","label":"Automation"}}]
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21289737