Event Message could not be found, but contained these strings

For some event IDs, I get "Event Message could not be found, but contained these strings" in the Hyena "Description" field when viewing events, but the Event Viewer shows it ok.
Is there a way to manually add these missing event descriptions?

[cmccullough]

Re: Event Message could not be found, but contained these strings

Descriptions are stored as pointers to a location in specific dlls. This error is indicating that either the dlls for this event type are missing on your computer, or are outdated.

You can look in the registry, under

HKEY_local_machine\System\CurrentControlSet\Servic es\EventLog\<Event Log Name>\<Event Source>, and look for the value of "EventMessageFile" to see if you can find the problem.

Re: Event Message could not be found, but contained these strings

I have the same problem for every off my machines (150).... A tool like DameWare show all events correctly ....why ??? it' the only once function of Hyena whitch cause to use another tools !!

Re: Event Message could not be found, but contained these strings

Ok, now that someone else is having this problem...
I run Hyena from my XP-SP2 PC and from the PDC which is W2K3-SP1.
The problem shows up from the Security logs of the W2000 servers on both of the machines running Hyena.

Looking at the registry key for the security logs I see that:

Win2k servers have SP2RES.dll, SP3RES.dll, and MsAuditE.dll.

Win2k3 has MsAuditE, WS03RES, and XPSP2RES.dll

XP-SP2 has MsAuditE, XPSP2Res.dll

What do you think needs to be copied/registered where?

[kstanush]

Re: Event Message could not be found, but contained these strings

There isn't any safe way to 'fix' this problem, as its probably caused by Hyena's performance preference to read the event messages locally if it finds them. What usually happens is that the messages (contained in the .dll files) are incompatible from one Windows version to the next.

You listed several files, but I'd like to verify exactly what the value is from the registry location referenced above, and if you can install and run Hyena locally on one of the machines, I'd like to verify that the problem goes away.

You can send the registry value to [email protected] if you want to.

Re: Event Message could not be found, but contained these strings

UPDATE:
The gurus have fixed this issue in the latest release of version 7.0! (7.01b)

Many thanks and kudos for such a quick fix!

[kstanush]

Re: Event Message could not be found, but contained these strings

We hope to release this as a patch next week (its being beta tested now). I will be called rev 'C'.

Re: Event Message could not be found, but contained these strings

Any update on this?

We are still having this issue with NT4 messages.

Thanks..

[kstanush]

Re: Event Message could not be found, but contained these strings

This issue was addressed in the last release (v7.0), and also v6.7 was patched at that time. The event log description should now show assuming the required files are present on the remote system. You can use the native event viewer to test.

Re: Event Message could not be found, but contained these strings

I must be missing something as we are running 7.0.1 Rev B. Is this the latest version ? Does this need a patch?

I have Hyena installed on my laptop ( XPSP2) and when I open the event log on our NT4 PDC, all the events with a source of NETLOGON give the 'Event message could not be found...' description. Going over the registry key listed in the previous post the message file associated with NETLOGON is netmsg.dll located in system32 directory. The file exists on the NT4 PDC in that directory. However, it is not present on my laptop anywhere.

Is Hyena looking in system32 on the laptop for the file ( and finding nothing) rather than looking on the PDC?

Any clarification would be much appreciated.