The publisher error from windows server to graylog


(Murat) #1

In recent days, this message appears on all graylog alerts:

AUDIT_FAILURE 4625 [The description for EventID 4625 from source Microsoft-Windows-Security-Auditing cannot be found: The publisher has been disabled and its resource is not available. This usually occurs when the publisher is in the process of being uninstalled or upgraded.

What can we do about it?


(Jesse Hills) #2

Hi @mcnsvr

This is actually an issue on the Windows-side of things (Aren’t Microsoft awesome?)

I found this thread which may help you in resolving this issue:
https://serverfault.com/questions/670269/windows-event-id-4624-repeating-with-resource-not-available

Thanks


(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.