Work with Custom Views / VNC Server

[P-a-d-r-a-i-g]

Hi,

I'm looking to implement this for VNC Server for failed logins.

The entry appears in "Application" log, with source "VNC Server", but can be missed sometimes due to timings.

The following is the invalid attempt text:

Connections: disconnected: 123.123.123.123::2258 (UDP) ([AuthFailure] Either the username was not recognised, or the password was incorrect)

The following is the invalid attempt XML:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="VNC Server" /> 
  <EventID Qualifiers="0">256</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>1</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2022-09-05T15:04:44.5293014Z" /> 
  <EventRecordID>72665</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer>TestPC2</Computer> 
  <Security /> 
  </System>
<EventData>
  <Data>Connections</Data> 
  <Data>disconnected: 123.123.123.123::2258 (UDP) ([AuthFailure] Either the username was not recognised, or the password was incorrect)</Data> 
  </EventData>
  </Event>

When I create a filter with the following it works fine, but ...

<EventPath>Application</EventPath>
<RegexBoosters>
    <Booster>[AuthFailure]</Booster>
</RegexBoosters>
<Regex>disconnected: (\d*.\d*.\d*.\d*)</Regex>

... but ... the "Application" log can get filled up too quickly and the EvlWatcher service can miss the unauthorised attempts.

I have created a "VNC Server" custom view under the "Custom View" tab of the Event Viewer but can't seem to make it work with the EvlWatcher service. There is no other place but for "Application" where this is logged.

How can I manage this one?

[devnulli]

Hi,
as I understand the mechanics of the .NET EventlogReader and Microsoft Event log, EvlWatcherService should not miss log entries, because he scans back by a timewindow, regardless of the event count.

Maybe, if you have unusally high upcoming of Application Log Entries, .Net EventlogReader would skip out on that.
Can you (if your question is still relevant, please excuse the slow response time) be more detailed (how many Entries between attempt and check), so i can try to reproduce that situation?

regard,
Mike