The publisher error from windows server to graylog

Graylog Central (peer support)
1

In recent days, this message appears on all graylog alerts:

AUDIT_FAILURE 4625 [The description for EventID 4625 from source Microsoft-Windows-Security-Auditing cannot be found: The publisher has been disabled and its resource is not available. This usually occurs when the publisher is in the process of being uninstalled or upgraded.

What can we do about it?

2

Hi @mcnsvr

This is actually an issue on the Windows-side of things (Aren’t Microsoft awesome?)

I found this thread which may help you in resolving this issue:
https://serverfault.com/questions/670269/windows-event-id-4624-repeating-with-resource-not-available

Thanks

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.