[osiris] The description for Event ID ( 0 ) in Source ( osirismd ) cannot be found.

[Joseph A. Kocan]

I can't for the life of me figure out why when a file gets changed and Osiris sends the event to the event viewer it gives an even ID 0, instead of a event ID 1001. I am using Osiris for Windows 4.2.3 installed on both the Management Service and the Scanning system. Here is what the event looks like when I create a new junk executable "junkexe.exe" in the windows directory between scans.

The description for Event ID ( 0 ) in Source ( osirismd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: [211][CL-2DC001][cmp][c:\windows\junkexe.exe][mtime][Wed Sep 19 15:44:56 2007][Wed Sep 19 16:13:55 2007].

When I look at the other events related to Osiris they look like a typical event, none of that "description can't be found" wording.

It seems that runtime events that Osiris generates are fine, but when a security event occurs it can't find the reference for it. I tried reinstalling the scanning service and reinstalling the management service on a new system, with no luck.

I also did google searches and tried looking in some of the archives, but still can't seem to figure out what is going wrong.

Has anyone else seen this? I am completely out of ideas.

Thanks,

Joe


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/osiris/attachments/20070919/d62c8cca/attachment.htm