« Previous Next »

Thread: Error opening event log "server\Application": Access is denied.

Last post 07-08-2009 10:16 PM by joelangley. 3 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (4 items)

Sort Posts:

  • 07-06-2009, 8:48 PM

    • kantravi
    • Not Ranked
    • Joined on 07-07-2009, 12:40 AM
    • Posts 2

    Error opening event log "server\Application": Access is denied.

    Using Log Parser and I am getting this error when I am trying to read the Application Events log remotely using the following query. 

    Cannot open <from-entity>: Error opening event log "server\Application":
      Access is denied. 

    EXEC xp_cmdshell 'C:\Parser\LogParser.EXE " SELECT 1,[EventID], [EventType], [SourceName], [TimeGenerated], [TimeWritten],[Message] INTO TempEvents12 FROM \\server\Application " -i:EVT -o:SQL -server:servername -database:dbname -driver:"SQL Server" -createTable:ON -stats OFF '

    I am running the query from Sql Server Management Studio. And the environment is Windows Server Enterprise - 2008.

    The user I am using is the member of: [Administrators], [Event Log Readers] and [Remote Desktop Users] Groups. And also I have provided the read access to the log file directory. But still I am getting the Access is denied error.

    Is Anyone has faced this isssue before ??

     

     

  • 07-07-2009, 10:26 PM In reply to

    Re: Error opening event log "server\Application": Access is denied.

    I got that error when going cross-domain to read event logs. I had to impersonate the account that was reading the logs. Are you on the same domain or different domains?

    Check out my blog for other cool tips and tricks:

    http://joelangley.blogspot.com/
  • 07-08-2009, 1:50 PM In reply to

    • kantravi
    • Not Ranked
    • Joined on 07-07-2009, 12:40 AM
    • Posts 2

    Re: Error opening event log "server\Application": Access is denied.

     

    I am trying to read from different domains. Please reply me back how you did it?

    Thanks

  • 07-08-2009, 10:16 PM In reply to

    Re: Error opening event log "server\Application": Access is denied.

    When reading cross-domain, even though the account is an admin you will come up with issues reading the event log. The way I see it you have 2 choices:

    1. Impersonation: You can write code that does impersonation. I did this in C# and then had my app impersonate an account on the other domain before making the logparser call. However, since you look like you are calling this from sql server it will be difficult to do that unless you are on sql 2008. 

    2. An option I did not do, but can work in your case is to use pass-through authentication. Basically, create a local account that has access to read the log on that local box. Then, create the same account on your current domain (the one you are running the command from). When you run the xp command, make sure you use that account as the context...it should now work. You can read up more on pass-through...just google it.

    Check out my blog for other cool tips and tricks:

    http://joelangley.blogspot.com/
Page 1 of 1 (4 items)
Microsoft Communities