mirror of
https://github.com/riverar/messageanalyzer-archive
synced 2026-06-08 17:10:57 +00:00
Rafael Rivera
1341 lines
104 KiB
Plaintext
1341 lines
104 KiB
Plaintext
//IMPORTANT INFORMATION:
|
|
//
|
|
//Please email MANetlogon@microsoft.com if you have suggestions or encounter issues with this parser.
|
|
//
|
|
//Issues may include:
|
|
// 1. Red "X" markers for unparsed lines
|
|
// 2. Lines being parsed incorrectly (variables do not match lines being parsed)
|
|
// 3. Calls being grouped incorrectly
|
|
|
|
//KEYWORD FILTERING OF THE NETLOGON PARSER TO LOOK FOR ISSUES:
|
|
// *Summary contains "DIAGNOSIS" -- Filters for all potential problems found
|
|
// *Summary contains "WARNING" -- Filters for account issues (expired passwords, disabled account authentication attempts, invalid username, etc.)
|
|
// *Summary contains "failure" -- Filters authentication failures
|
|
// *Summary contains "WRONG" -- Filters "wrong password" authentication attempts
|
|
// *Summary contains "authentication" -- Filters all authentication calls
|
|
// *Summary contains "failed" -- General query for the term "failed"
|
|
// *Summary contains "error" -- General query for the term "error"
|
|
// *username == "<username>" -- Filters log file for a specific user account
|
|
// *originMachine == "<user machine> -- Filters log file for a specific machine
|
|
// *relayMachine == "<app server/auth proxy>" -- Filters log file for the machine proxying the authentication request (Exchange server, web server, etc.)
|
|
// *otherText contains "Kerberos" -- Filters Kerberos PAC validation requests
|
|
// *otherText contains "Package" -- Filters authentication requests that are not NTLM (Kerberos PAC validation, Schannel, etc)
|
|
|
|
|
|
//POWERSHELL COMMANDS FOR RUNNING THE PARSER:
|
|
// import-module PEF
|
|
// $TraceSession01 = New-PefTraceSession -Force -Path <Path>\<OutputFileName>.matp -SaveOnStop
|
|
// Add-PefMessageSource -PEFSession $TraceSession01 -Provider "<Path to Netlogon log>" -LogConfig Netlogon
|
|
// Start-PefTraceSession -PEFSession $TraceSession01
|
|
//
|
|
// NOTE: $TraceSession01 can be renamed to whatever variable name you'd like
|
|
|
|
|
|
//----------------------------------------------------------------------------------------------
|
|
//----------------------------REVISIONS HISTORY ------------------------------------------------
|
|
//
|
|
// 8/13/14 v1.0.0 Initial release version
|
|
// 8/14/14 v1.0.1 Added Proxied authentication calls and groupings for authentication calls missing machine names
|
|
// 12/24/14 v1.0.2 Modified translations/summary wording
|
|
// 12/24/14 v1.0.3 Added additional no_client_site mapping messages and operations
|
|
// 12/26/14 v1.0.4 Fixed issue where timestamps are off by -UTC time
|
|
// 12/26/14 v1.0.5 Added addition of "sysvol not ready" status detection
|
|
// 12/27/14 v1.0.6 Added fast track troubleshooting areas for specific error codes and lines (account lockouts, no logon servers, RPC call cancellation, no memory, insufficient resources, invalid server state, etc.)
|
|
// 12/28/14 v1.0.7 Added additional fast track troubleshooting areas for specific error codes and refined parsing to improve performance
|
|
// 12/28/14 v1.0.8 Eliminated duplicate messages and unnecessary parsing in certain areas
|
|
// 12/28/14 v1.0.9 Combined MCA detection messages to improve parser performance
|
|
// 12/28/14 v1.1.0 Combined SChannel authentication calls into single parsing method and operational grouping to improve performance
|
|
// 12/28/14 v1.1.1 Combined Kerberos PAC validation calls into single parsing method and operational grouping to improve performance
|
|
// 12/28/14 v1.1.2 Combined variables for authentication calls to enhance performance
|
|
// 12/29/14 v1.1.3 Correcting summary wording for some messages and operations, renumbering message priorities, and updating tree numbering scheme
|
|
// 12/30/14 v1.1.4 Re-prioritized catchall messages and cleaned up code
|
|
// 4/16/15 v1.1.5 Corrected misworded response statement for ProxiedSamLogon and fixed combination
|
|
// 5/15/15 v1.1.6 Further combined messages to increase performance
|
|
// 5/15/15 v1.1.7 Re-wording summary statements and adding "no client site" references for cases where operations are disabled for parsing
|
|
// 5/15/15 v1.1.8 Combining "no client site" messages to further enhance performance
|
|
// 5/15/15 v1.1.9 Correcting wording of more summary messages
|
|
// 5/18/15 v2.0 Combining messages further to enhance performance
|
|
// 5/19/15 v2.1 Performance enhancements (elimination of multiple catch all messages)
|
|
// 5/27/15 v2.2 Combining diagnosis detection into CatchAll message to enhance performance
|
|
// 6/17/15 v2.4 Adding additional error detection
|
|
// 6/20/15 v2.5 Added additional error detection and streamlined wording to allow for easier filtering
|
|
// 6/20/15 v2.6 Added error code detection into authentication strings and customized summary output to include the failure
|
|
// 6/20/15 v2.7 Added additional error code detection
|
|
// 6/20/15 v2.8 Breaking out "log issue" lines to pull out authentication calls and preemptively add code to break down defined error code results
|
|
// 6/20/15 v2.9 Breaking out "log issue" lines to pull out defined all error codes that are not related to authentication calls
|
|
// 6/20/15 v3.0 Minor wording adjustments
|
|
// 6/24/15 v3.1 Removing individual authentication message types and adding filtering to improve performance
|
|
// 6/26/15 v3.2 Added single authentication message to capture all authentications filter status to ease sequence expression creation
|
|
// 6/26/15 v3.3 Split out various variables to account for null authentication attempts and split out the domain name and user name
|
|
// 7/2/15 v3.3.1 Removing case sensitivity for filtering and adding true line content for some calls
|
|
// 7/7/15 v3.4 Added operation to combine authentication calls and provide output summary based on success or specific error codes
|
|
// 7/14/15 v3.5 Added code to incorporate currently undefined errors and added additional error code
|
|
//
|
|
//
|
|
//----------------------------------------------------------------------------------------------
|
|
//----------------------------------------------------------------------------------------------
|
|
|
|
|
|
using Diagnostics;
|
|
using Utility;
|
|
//==============================================================================================
|
|
//==============================================================================================
|
|
// NETLOGON BASE FOR DATE/TIME CONVERSION
|
|
//==============================================================================================
|
|
//==============================================================================================
|
|
|
|
message BaseNetLogon : LogEntry
|
|
{
|
|
string nlts;
|
|
string msgtype;
|
|
}
|
|
|
|
syntax CustomDateTimeFormat = month:regex{[0-9][0-9]?} "/" day:regex{[0-9][0-9]?} " " hours:regex{[0-9][0-9]?} ":" minutes:regex{[0-9][0-9]?} ":" seconds:regex{[0-9][0-9]?} => ToDateTime("1601-" + month + "-" + day + "T" + hours + ":" + minutes + ":" + seconds, DateTimeStyles.None);
|
|
|
|
DateTime get nltsDateTime(this BaseNetLogon msg) with EntryFieldInfo {IsTimestamp = true, IsLocalTime = true }
|
|
{
|
|
optional DateTime theDateTime = CustomDateTimeFormat(msg.nlts);
|
|
if(theDateTime == nothing)
|
|
{
|
|
return CustomDateTimeFormat("01/07 12:34:56") as DateTime;
|
|
}
|
|
else
|
|
{
|
|
return theDateTime as DateTime;
|
|
}
|
|
}
|
|
|
|
|
|
//================================================================================================================
|
|
//================================================================================================================
|
|
// PARSING MESSAGES
|
|
//================================================================================================================
|
|
//================================================================================================================
|
|
|
|
//1
|
|
message AuthenticationRequestOrResponse with
|
|
EntryInfo { Regex = @"(?<nlts>[/0-9]+\s[/:0-9]+) \[(?<msgtype>[\S]+)\] (?<authNumAndOrDomainName>.*)?SamLogon: (?<logonType>[\S\u0020]+) logon of (?<domainName>[\S]+[.*\\])?(?<userName>[\S]+) from (?<originMachine>[\S\w]+)? (.*\(via)?( (?<relayMachine>[\S]+)[(.*\)?])?(?<otherText>.*)?(.*Returns|.*Entered)( (?<errorCode>[\S]+))?$" //SHOULD ADDRESS NULL AUTHS AND IGNORE MISSING DOMAIN NAME AND/OR BACKSLASH
|
|
, Priority = 0
|
|
}
|
|
: BaseNetLogon
|
|
{
|
|
string authNumAndOrDomainName;
|
|
string logonType;
|
|
string domainName;
|
|
string userName;
|
|
string originMachine;
|
|
string relayMachine;
|
|
string otherText;
|
|
string errorCode;
|
|
|
|
override string ToString()
|
|
{
|
|
if (errorCode != "")
|
|
{
|
|
if (relayMachine != "")
|
|
{
|
|
if (originMachine != "")
|
|
{if (errorCode == "0x0")
|
|
return ("Authentication success returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000199")
|
|
return ("Authentication failure of NO LOGON WORKSTATION TRUST ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication returned with an undefined error code for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
else
|
|
{if (errorCode == "0x0")
|
|
return ("Authentication success returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000199")
|
|
return ("Authentication failure of NO LOGON WORKSTATION TRUST ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication returned with an undefined error code for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (originMachine != "")
|
|
{if (errorCode == "0x0")
|
|
return ("Authentication success returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000199")
|
|
return ("Authentication failure of NO LOGON WORKSTATION TRUST ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication returned with an undefined error code for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
else
|
|
{if (errorCode == "0x0")
|
|
return ("Authentication success returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000199")
|
|
return ("Authentication failure of NO LOGON WORKSTATION TRUST ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication returned with an undefined error code for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
if (relayMachine != "")
|
|
{
|
|
if (originMachine != "")
|
|
return ("Authentication entered for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon.");
|
|
|
|
else
|
|
return ("Authentication entered for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon.");
|
|
|
|
}
|
|
else
|
|
{
|
|
if (originMachine != "")
|
|
return ("Authentication entered for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon.");
|
|
|
|
else
|
|
return ("Authentication entered for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon.");
|
|
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
|
|
//2
|
|
message NoClientSite with
|
|
EntryInfo { Regex = @"(?<nlts>[/0-9]+\s[/:0-9]+) (?<authNumAndOrDomainName>.*)?NO_CLIENT_SITE: (?<machineName1>[\S\w]+) (?<ipAddress>[\S\w]+)"
|
|
, Priority = 0
|
|
}
|
|
: BaseNetLogon
|
|
{
|
|
string authNumAndOrDomainName;
|
|
string machineName1;
|
|
string ipAddress;
|
|
|
|
override string ToString()
|
|
{
|
|
return ("No client site detected! Missing subnet is: " + ipAddress + " --- Detected machine name is: " + machineName1);
|
|
}
|
|
}
|
|
|
|
//3
|
|
message CatchAll with
|
|
EntryInfo { Regex = @"(?<nlts>[/0-9]+\s[/:0-9]+) \[(?<msgtype>[\S]+)\](?<RemainingText>.*)"
|
|
, Priority = 1
|
|
}
|
|
: BaseNetLogon
|
|
{
|
|
string RemainingText;
|
|
|
|
override string ToString()
|
|
{ if (RemainingText.IndexOf("Can't allocate Client API slot", false) != -1)
|
|
return ("DIAGNOSIS: A MaxConcurrentApi issue has been detected! " + RemainingText);
|
|
else if (RemainingText.IndexOf("Status is 10055", false) != -1)
|
|
return ("DIAGNOSIS: A RPC/Winsock port exhaustion issue has been detected! This may lead to authentication timeouts and a lack of basic network connectivity! If you are currently having network connectivity or authentication related issues this is the probable root cause. Please begin further investigation for this issue by using netstat -anob to identify the process leading to port exhaustion! " + RemainingText);
|
|
else if (RemainingText.IndexOf("Status is 10060", false) != -1)
|
|
return ("DIAGNOSIS: A RPC/Winsock timeout has been detected! This may lead to authentication timeouts and a lack of basic network connectivity! If you are currently having network connectivity or authentication related issues this is a possible root cause. " + RemainingText);
|
|
else if (RemainingText.IndexOf("Status is 1237", false) != -1)
|
|
return ("DIAGNOSIS: A retry status was detected! " + RemainingText);
|
|
else if (RemainingText.IndexOf("Returning paused", false) != -1)
|
|
return ("DIAGNOSIS: Domain controller is not advertising due to SYSVOL not being ready! This means you are having problems sharing the SYSVOL share! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000234", false) != -1)
|
|
return ("ACCOUNT WARNING: An account lockout has been detected for a user in the domain. You should evaluate authentication calls for c0000234 returns to identify locked out users! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c003000c", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected RPC bad stub data errors! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020050", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected a RPC call cancellation! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000018c", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected a problem with the trust to the target domain! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000017", false) != -1)
|
|
return ("DIAGNOSIS: The local or target machine is out of memory! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000005e", false) != -1)
|
|
return ("DIAGNOSIS: A no logon servers available error has been detected! There may be problems contacting the target domain. If you see this in conjunction with MaxConcurrentApi detection then this is expected; otherwise please check the authentication chain for problems. " + RemainingText);
|
|
else if (RemainingText.IndexOf("c00000dc", false) != -1)
|
|
return ("DIAGNOSIS: An invalid server state has been detected. This typically means the domain controller or Netlogon service is shutting down or restarting. " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000009a", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected the local or target machine has insufficient resources to complete the operation. Please check memory, including paged/nonpaged pool, as well as overall server health! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000018a", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected the lack of a trust/LSA secret for the local or target machine. Please ensure you have a valid secure channel with the domain and that trusts are operational! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000022", false) != -1)
|
|
return ("DIAGNOSIS: Access was denied for a call made to Netlogon! " + RemainingText);
|
|
else if (RemainingText.IndexOf("00000005") != -1)
|
|
return ("DIAGNOSIS: Access was denied for a call made to Netlogon! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000192", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected that the Netlogon service is not started or the domain controller is not advertising itself properly! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020008", false) != -1)
|
|
return ("DIAGNOSIS: An attempt to contact an invalid network address or an out of memory condition was detected. " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020017", false) != -1)
|
|
return ("DIAGNOSIS: A RPC server unavailable message has been detected! Please verify you can resolve the target machine or domain, that all required ports are opened, and that you have not exhausted ephemeral ports! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000006d", false) != -1)
|
|
return ("ACCOUNT WARNING: An invalid attempt to authenticate was detected. Either a bad username or invalid authentication information was provided! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c002001b", false) != -1)
|
|
return ("DIAGNOSIS: A RPC server call failure has been detected! Please verify you can resolve the target machine or domain, that all required ports are opened, and that you have not exhausted ephemeral ports! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000072", false) != -1)
|
|
return ("ACCOUNT WARNING: A disabled account has attempted to log onto the system or domain! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020030", false) != -1)
|
|
return ("ACCOUNT WARNING: An authentication attempt has occurred from an unknown authentication service/mechanism! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000006f", false) != -1)
|
|
return ("ACCOUNT WARNING: A user has attempted to logon outside of their assigned logon hours! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000193", false) != -1)
|
|
return ("ACCOUNT WARNING: An expired account has attempted to log onto the system or domain! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000001", false) != -1)
|
|
return ("DIAGNOSIS: An unsuccessful attempt has been detected! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000006a", false) != -1)
|
|
return ("WRONG PASSWORD: A user has attempted to use an incorrect password! This may lead to account lockouts! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000064", false) != -1)
|
|
return ("ACCOUNT WARNING: An invalid user account has attempted to authenticate! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000071", false) != -1)
|
|
return ("ACCOUNT WARNING: A user has attempted to use an expired password! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000199", false) != -1)
|
|
return ("DIAGNOSIS: The parser has detected a NO LOGON WORKSTATION TRUST ACCOUNT error. You may have authentication calls being attempted by machine accounts instead of user accounts!");
|
|
|
|
else if (RemainingText.IndexOf("Try to find a better DC for this operation", false) != -1)
|
|
return ("DIAGNOSIS: A search for a better DC for this operation has been initiated! This may not be a problem, but may indicate problems with efficient DC Locator functionality. " + RemainingText);
|
|
else if (RemainingText.IndexOf("failed", false) != -1)
|
|
return ("DIAGNOSIS: " + msgtype + ": " + RemainingText);
|
|
else if (RemainingText.IndexOf("error", false) != -1)
|
|
return ("DIAGNOSIS: " + msgtype + ": " + RemainingText);
|
|
else if (msgtype == "INIT")
|
|
{if (RemainingText.IndexOf("NeverPing = FALSE", false) != -1)
|
|
return ("SERVICE STARTUP: NeverPing is DISABLED! This may lead to excessive resource utilization on domain controllers when null authentications are attempted that do not contain user UPNs, or that are not for non-NTLM security packages. " + RemainingText);
|
|
else
|
|
return ("SERVICE STARTUP: " + RemainingText);
|
|
}
|
|
else
|
|
return (msgtype + ": " + RemainingText);
|
|
}
|
|
}
|
|
|
|
//4
|
|
message NoHeaderWithTimestamp with
|
|
EntryInfo { Regex = @"(?<nlts>[/0-9]+\s[/:0-9]+)(?<RemainingText>.*)"
|
|
, Priority = 3
|
|
}
|
|
: BaseNetLogon
|
|
{
|
|
string RemainingText;
|
|
|
|
override string ToString()
|
|
{
|
|
return (RemainingText);
|
|
}
|
|
}
|
|
|
|
//5
|
|
message NoStandardInfo with
|
|
EntryInfo { Regex = @"(?<RemainingText>.*)"
|
|
, Priority = 2
|
|
}
|
|
: LogEntry
|
|
{
|
|
string RemainingText;
|
|
|
|
override string ToString()
|
|
{if (RemainingText.IndexOf("ClientSession:", false) != -1)
|
|
{ if (RemainingText.IndexOf("SamLogon:", false) != -1)
|
|
{ if (RemainingText.IndexOf("Entered", false) != -1)
|
|
return ("LOG INCONSISTENCY: Authentication entered: " + RemainingText);
|
|
else if (RemainingText.IndexOf("0x0") != -1)
|
|
return ("LOG INCONSISTENCY: Authentication success returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000234", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C003000C", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of RPC BAD STUB DATA returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0020050", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of RPC CALL CANCELLED returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000018C", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of TRUSTED DOMAIN FAILURE returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000017", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of NO MEMORY returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000005E", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of NO LOGON SERVERS AVAILABLE returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C00000DC", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of INVALID SERVER STATE returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000009A", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of INSUFFICIENT RESOURCES returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000018A", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of NO TRUST LSA SECRET returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000022", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of ACCESS DENIED returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("00000005") != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of ACCESS DENIED returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000192", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of NETLOGON SERVICE NOT STARTED returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0020008", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0020017", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of RPC SERVER IS UNAVAILABLE returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000006D", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C002001B", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of RPC CALL FAILED returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000072", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0020030", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000006F", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000193", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000001", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of UNSUCCESSFUL returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C000006A", false) != -1)
|
|
return ("LOG INCONSISTENCY WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000064", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of NO SUCH USER returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("C0000071", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned: " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000199", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Authentication failure of NO LOGON WORKSTATION TRUST ACCOUNT returned. You may have authentication calls being attempted by machine accounts instead of user accounts!" + RemainingText);
|
|
|
|
else
|
|
return ("LOG INCONSISTENCY: Authentication status was not identified: " + RemainingText);
|
|
}
|
|
else if (RemainingText.IndexOf("Can't allocate Client API slot", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A MaxConcurrentApi issue has been detected! " + RemainingText);
|
|
else if (RemainingText.IndexOf("Status is 10055", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A RPC/Winsock port exhaustion issue has been detected! This may lead to authentication timeouts and a lack of basic network connectivity! If you are currently having network connectivity or authentication related issues this is the probable root cause. Please begin further investigation for this issue by using netstat -anob to identify the process leading to port exhaustion! " + RemainingText);
|
|
else if (RemainingText.IndexOf("Status is 10060", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A RPC/Winsock timeout has been detected! This may lead to authentication timeouts and a lack of basic network connectivity! If you are currently having network connectivity or authentication related issues this is a possible root cause. " + RemainingText);
|
|
else if (RemainingText.IndexOf("Status is 1237", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A retry status was detected! " + RemainingText);
|
|
else if (RemainingText.IndexOf("Returning paused", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Domain controller is not advertising due to SYSVOL not being ready! This means you are having problems sharing the SYSVOL share! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000234", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: An account lockout has been detected for a user in the domain. You should evaluate authentication calls for c0000234 returns to identify locked out users! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c003000c", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected RPC bad stub data errors! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020050", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected a RPC call cancellation! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000018c", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected a problem with the trust to the target domain! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000017", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The local or target machine is out of memory! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000005e", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A no logon servers available error has been detected! There may be problems contacting the target domain. If you see this in conjunction with MaxConcurrentApi detection then this is expected; otherwise please check the authentication chain for problems. " + RemainingText);
|
|
else if (RemainingText.IndexOf("c00000dc", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: An invalid server state has been detected. This typically means the domain controller or Netlogon service is shutting down or restarting. " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000009a", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected the local or target machine has insufficient resources to complete the operation. Please check memory, including paged/nonpaged pool, as well as overall server health! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000018a", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected the lack of a trust/LSA secret for the local or target machine. Please ensure you have a valid secure channel with the domain and that trusts are operational! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000022", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Access was denied for a call made to Netlogon! " + RemainingText);
|
|
else if (RemainingText.IndexOf("00000005") != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: Access was denied for a call made to Netlogon! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000192", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected that the Netlogon service is not started or the domain controller is not advertising itself properly! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020008", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: An attempt to contact an invalid network address or an out of memory condition was detected. " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020017", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A RPC server unavailable message has been detected! Please verify you can resolve the target machine or domain, that all required ports are opened, and that you have not exhausted ephemeral ports! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000006d", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: An invalid attempt to authenticate was detected. Either a bad username or invalid authentication information was provided! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c002001b", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A RPC server call failure has been detected! Please verify you can resolve the target machine or domain, that all required ports are opened, and that you have not exhausted ephemeral ports! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000072", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: A disabled account has attempted to log onto the system or domain! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0020030", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: An authentication attempt has occurred from an unknown authentication service/mechanism! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000006f", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: A user has attempted to logon outside of their assigned logon hours! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000193", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: An expired account has attempted to log onto the system or domain! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000001", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: An unsuccessful attempt has been detected! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c000006a", false) != -1)
|
|
return ("LOG INCONSISTENCY WRONG PASSWORD: A user has attempted to use an incorrect password! This may lead to account lockouts! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000064", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: An invalid user account has attempted to authenticate! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000071", false) != -1)
|
|
return ("LOG INCONSISTENCY ACCOUNT WARNING: A user has attempted to use an expired password! " + RemainingText);
|
|
else if (RemainingText.IndexOf("c0000199", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: The parser has detected a NO LOGON WORKSTATION TRUST ACCOUNT error. You may have authentication calls being attempted by machine accounts instead of user accounts!" + RemainingText);
|
|
else if (RemainingText.IndexOf("Try to find a better DC for this operation", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: A search for a better DC for this operation has been initiated! This may not be a problem, but may indicate problems with efficient DC Locator functionality. " + RemainingText);
|
|
else if (RemainingText.IndexOf("failed", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: " + RemainingText);
|
|
else if (RemainingText.IndexOf("error", false) != -1)
|
|
return ("LOG INCONSISTENCY DIAGNOSIS: " + RemainingText);
|
|
else if (RemainingText.IndexOf("INIT") != -1)
|
|
{if (RemainingText.IndexOf("NeverPing = FALSE", false) != -1)
|
|
return ("LOG INCONSISTENCY SERVICE STARTUP: NeverPing is DISABLED! This may lead to excessive resource utilization on domain controllers when null authentications are attempted that do not contain user UPNs, or that are not for non-NTLM security packages. " + RemainingText);
|
|
else
|
|
return ("LOG INCONSISTENCY SERVICE STARTUP: " + RemainingText);
|
|
}
|
|
else
|
|
return ("LOG INCONSISTENCY: " + RemainingText);
|
|
}
|
|
else
|
|
return ("LOG INCONSISTENCY: Non-ClientSession: " + RemainingText);
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
//============================================================================================================//
|
|
//============================================================================================================//
|
|
//============================================================================================================//
|
|
//----------- OPERATIONS SECTION ----------------//
|
|
//============================================================================================================//
|
|
//============================================================================================================//
|
|
//============================================================================================================//
|
|
|
|
/*
|
|
//1
|
|
operation Authentication
|
|
{
|
|
in string userName;
|
|
string authNumAndOrDomainName;
|
|
string logonType;
|
|
string domainName;
|
|
string originMachine;
|
|
string relayMachine;
|
|
string otherText;
|
|
out string errorCode;
|
|
|
|
override string ToString()
|
|
|
|
|
|
{
|
|
if (relayMachine != "")
|
|
{
|
|
if (originMachine != "")
|
|
{if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication success returned for " + domainName + userName + " from " + originMachine + ". This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
else
|
|
{if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication success returned for " + domainName + userName + " from an unknown machine. This was proxied by " + relayMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (originMachine != "")
|
|
{if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication success returned for " + domainName + userName + " from " + originMachine + ". The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
else
|
|
{if (errorCode == "0xC000005E")
|
|
return ("Authentication failure of NO LOGON SERVERS AVAILABLE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000234")
|
|
return ("ACCOUNT WARNING: Authentication failure of ACCOUNT LOCKED OUT returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC003000C")
|
|
return ("Authentication failure of RPC BAD STUB DATA returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020050")
|
|
return ("Authentication failure of RPC CALL CANCELLED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018C")
|
|
return ("Authentication failure of TRUSTED DOMAIN FAILURE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000017")
|
|
return ("Authentication failure of NO MEMORY returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC00000DC")
|
|
return ("Authentication failure of INVALID SERVER STATE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000009A")
|
|
return ("Authentication failure of INSUFFICIENT RESOURCES returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000018A")
|
|
return ("Authentication failure of NO TRUST LSA SECRET returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000022")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0x00000005")
|
|
return ("Authentication failure of ACCESS DENIED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000192")
|
|
return ("Authentication failure of NETLOGON SERVICE NOT STARTED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020008")
|
|
return ("Authentication failure of INVALID NETWORK ADDRESS OR OUT OF MEMORY returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020017")
|
|
return ("Authentication failure of RPC SERVER IS UNAVAILABLE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006D")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON FAILURE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC002001B")
|
|
return ("Authentication failure of RPC CALL FAILED returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000072")
|
|
return ("ACCOUNT WARNING: Authentication failure of DISABLED ACCOUNT returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0020030")
|
|
return ("ACCOUNT WARNING: Authentication failure of UNKNOWN AUTHENTICATION SERVICE returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006F")
|
|
return ("ACCOUNT WARNING: Authentication failure of LOGON HOURS RESTRICTION returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000193")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED ACCOUNT returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000064")
|
|
return ("ACCOUNT WARNING: Authentication failure of NO SUCH USER returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000071")
|
|
return ("ACCOUNT WARNING: Authentication failure of EXPIRED PASSWORD returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC000006A")
|
|
return ("WRONG PASSWORD: Authentication failure of WRONG PASSWORD returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else if (errorCode == "0xC0000001")
|
|
return ("Authentication failure of UNSUCCESSFUL returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
else
|
|
return ("Authentication success returned for " + domainName + userName + " from an unknown machine. The type of logon was a " + logonType + " logon, and the result was " + errorCode + ".");
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
autostart actor LogSinkToAuthenticationPairing(LogSink ls)
|
|
{
|
|
process ls accepts m:LogEntry
|
|
{
|
|
switch(m)
|
|
{
|
|
case AuthenticationRequestOrResponse =>
|
|
dispatch (endpoint AuthenticationPairingEndpoint over ls) accepts m;
|
|
default =>
|
|
reject;
|
|
}
|
|
}
|
|
}
|
|
|
|
endpoint AuthenticationPairingOperationSink accepts any message;
|
|
|
|
|
|
|
|
message AuthenticationDummyMessage{}
|
|
endpoint AuthenticationDummyEndpoint accepts AuthenticationDummyMessage
|
|
{
|
|
map<string, array<AuthenticationRequestOrResponse> > requests = {};
|
|
}
|
|
|
|
endpoint AuthenticationPairingEndpoint over LogSink accepts Authentication accepts AuthenticationRequestOrResponse
|
|
{
|
|
|
|
process this accepts sl:AuthenticationRequestOrResponse
|
|
{
|
|
var de = endpoint AuthenticationDummyEndpoint;
|
|
map<string, array<AuthenticationRequestOrResponse> > requests = de.requests;
|
|
|
|
var isRequest = sl.errorCode == "";
|
|
//LogLine("Accepts AuthenticationRequestOrResponse");
|
|
//LogLine("Map keys before " + (requests.Keys as string));
|
|
|
|
string key = makeKey(sl);
|
|
if (key in requests)
|
|
{
|
|
|
|
if (isRequest)
|
|
|
|
{
|
|
//LogLine("Adding " + key + " to requests. Current size: " + (requests[key].Count as string));
|
|
requests[key] = requests[key] + [sl];
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
//LogLine("Retrieving " + key + " from requests");
|
|
|
|
AuthenticationRequestOrResponse request = requests[key][0];
|
|
|
|
requests[key] = requests[key].Segment(1);
|
|
|
|
if (requests[key].Count == 0)
|
|
|
|
{
|
|
|
|
//LogLine("Removing " + key + " from requests");
|
|
|
|
requests.Remove(key);
|
|
|
|
}
|
|
|
|
Authentication slop = new Authentication{userName = request.userName, authNumAndOrDomainName = request.authNumAndOrDomainName, domainName = request.domainName, logonType = request.logonType, originMachine = request.originMachine, relayMachine = request.relayMachine, otherText = request.otherText, errorCode = sl.errorCode};
|
|
array<any message> vopOrigins = [];
|
|
|
|
vopOrigins += [request];
|
|
|
|
vopOrigins += [sl];
|
|
|
|
slop.Origins = vopOrigins;
|
|
|
|
|
|
dispatch (endpoint AuthenticationPairingOperationSink) accepts slop;
|
|
|
|
}
|
|
}
|
|
else
|
|
{
|
|
|
|
if (isRequest)
|
|
|
|
{
|
|
//LogLine("Adding " + key + " to requests for the first time");
|
|
requests[key] = [sl];
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
//LogLine("Key " + key + " not found");
|
|
|
|
|
|
ValidationCheck(false, sl, "Request without response");
|
|
|
|
dispatch (endpoint AuthenticationPairingOperationSink) accepts sl;
|
|
|
|
}
|
|
}
|
|
//LogLine("Map keys after " + (requests.Keys as string));
|
|
de.requests = requests;
|
|
}
|
|
|
|
~endpoint(AuthenticationPairingEndpoint pe)
|
|
{
|
|
|
|
var de = endpoint AuthenticationDummyEndpoint;
|
|
map<string, array<AuthenticationRequestOrResponse> > requests = de.requests;
|
|
|
|
//LogLine("Releasing. " + (requests as string));
|
|
|
|
foreach(string key in requests.Keys)
|
|
{
|
|
foreach(AuthenticationRequestOrResponse req in requests[key])
|
|
{
|
|
ValidationCheck(false, req, "Response never arrived");
|
|
release req;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
static string makeKey(AuthenticationRequestOrResponse sl)
|
|
{
|
|
return sl.userName + sl.domainName + sl.authNumAndOrDomainName + sl.originMachine + sl.relayMachine + sl.logonType;
|
|
}
|
|
|
|
*/
|
|
|
|
|
|
|
|
//=============================================================================================
|
|
//=============================================================================================
|
|
// INTERLEAVE OPERATIONS
|
|
//=============================================================================================
|
|
//=============================================================================================
|
|
endpoint InterleaveOperationSink accepts any message;
|
|
|
|
autostart actor InterleaveOperationsDispatcher(LogSink ep)
|
|
{
|
|
process ep accepts m:LogEntry
|
|
{
|
|
switch (m)
|
|
{
|
|
case NoClientSite =>
|
|
dispatch (endpoint NoClientSiteDetectionEndpoint over ep) accepts m;
|
|
case NoHeaderWithTimestamp =>
|
|
dispatch (endpoint NoHeaderWithTimestampDetectionEndpoint over ep) accepts m;
|
|
default =>
|
|
reject;
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
|
|
//1
|
|
operation NoClientSiteDetection
|
|
{
|
|
in string MissingSite = "Missing site and subnet associations have been detected. Please expand grouping for details.";
|
|
|
|
override string ToString()
|
|
{
|
|
return "No client site/Missing site and subnet associations have been detected. Please expand this grouping to identify the missing subnets!";
|
|
}
|
|
}
|
|
|
|
endpoint NoClientSiteDetectionEndpoint over LogSink accepts NoClientSite
|
|
{
|
|
array<any message> messages = [];
|
|
|
|
~endpoint(NoClientSiteDetectionEndpoint ep)
|
|
{
|
|
var op = new NoClientSiteDetection{};
|
|
op.Origins = messages;
|
|
dispatch (endpoint InterleaveOperationSink) accepts op;
|
|
messages = null;
|
|
}
|
|
|
|
process this accepts m:NoClientSite
|
|
{
|
|
messages += [m];
|
|
}
|
|
}
|
|
|
|
//2
|
|
operation NoHeaderWithTimestampDetection
|
|
{
|
|
in string NoHeaderWithTimestampMsg = "The lines grouped here are typically not useful for troubleshooting! Please expand grouping for details.";
|
|
|
|
override string ToString()
|
|
{
|
|
return "The lines grouped here are typically not useful for troubleshooting! Please expand grouping for details.";
|
|
}
|
|
}
|
|
|
|
endpoint NoHeaderWithTimestampDetectionEndpoint over LogSink accepts NoHeaderWithTimestamp
|
|
{
|
|
array<any message> messages = [];
|
|
|
|
~endpoint(NoHeaderWithTimestampDetectionEndpoint ep)
|
|
{
|
|
var op = new NoHeaderWithTimestampDetection{};
|
|
op.Origins = messages;
|
|
dispatch (endpoint InterleaveOperationSink) accepts op;
|
|
messages = null;
|
|
}
|
|
|
|
process this accepts m:NoHeaderWithTimestamp
|
|
{
|
|
messages += [m];
|
|
}
|
|
}
|