IBM Support

WinCollect error code 0x0000: 'Failed to switch security credentials for event log'

Question & Answer


Question

WinCollect agents can experience an error code 0x0000: 'Failed to switch security credentials for event log', This error message is typically associated with a login error.

Answer

When this error message is present in the error logs for WinCollect, it indicates that some form of login error occurred.



Error Message Example
2014-08-06 20:26:54,776 ERROR Device.WindowsLog.EventLogMonitor : Failed to switch security credentials for event log IP ADDRESS [\\IP ADDRESS:Security]; will try to reopen in approx 60 seconds. Reason: Error code 0x0000: The operation completed successfully.
2014-08-06 20:26:54,776 ERROR Device.WindowsLog.EventLogMonitor : Failed to switch security credentials for event log IP ADDRESS [\\IP ADDRESS:Security]; will try to reopen in approx 60 seconds. Reason: Error code 0x0000: The operation completed successfully.


This error message can generated due to the following configuration problems:
  • The WinCollect agent is not on the latest version. Administrators can review the latest version available on IBM Fix Central to update their Console using the SFS file.
  • The password provided in the log source might be too long (over 100 characters).
  • The credentials are incorrect in the log source configuration.




Where do you find more information?


[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"WinCollect","Platform":[{"code":"PF033","label":"Windows"}],"Version":"7.2;7.3","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
10 May 2019

UID

swg21681816

Page Feedback