topic Re: User-ID Agent - [Error 115]: Cannot open security log for DC.. in General Topics

User-ID Agent - [Error 115]: Cannot open security log for DC..

AllwynMascarenhas — Sun, 30 Sep 2018 20:09:52 GMT

These errors just don't make sense to me, I have followed everything as required.

I am currently doing this in my lab and I'm stuck with this error about permissions, I have given permisions for event log readers, server operators and distributed com users.

Any ideas on what's missing?

I have installed the agent on win7 and the AD is on win srv 2012.

09/30/18 23:59:40:445[ Info 2145]: ------------Service is being started------------

09/30/18 23:59:40:445[ Info 2152]: Os version is 6.1.1.

09/30/18 23:59:40:445[ Info 608]: Load debug log level Info.

09/30/18 23:59:40:445[ Info 557]: Service version is 8.0.10.7.

09/30/18 23:59:40:445[ Info 611]: Product version is 8.0.10.

09/30/18 23:59:40:460[ Info 1132]: Found 0 ACL config. 0 processed.

09/30/18 23:59:40:460[ Info 1160]: Found 0 VM info source config. 0 processed.

09/30/18 23:59:40:460[ Info 1168]: Found 0 Syslog Profile(s) config.

09/30/18 23:59:40:460[ Info 1230]: Found 1 server config.

09/30/18 23:59:40:460[ Info 1265]: Found 0 include-exclude networks. 0 processed.

09/30/18 23:59:40:460[ Info 1290]: Found 0 custom log format config.

09/30/18 23:59:40:460[ Info 1297]: No xml element servercert.

09/30/18 23:59:40:460[ Info 148]: Load 8 build-in formats and 0 custom formats for parsing security log.

09/30/18 23:59:40:460[ Info 345]: DC security log and session query threads for server dc.akmlab.com(index 0) are started.

09/30/18 23:59:40:460[ Info 707]: Active Directory gets started.

09/30/18 23:59:40:460[ Info 742]: User-ID VM monitor service started.

09/30/18 23:59:40:460[ Warn 923]: Unsupported file format for UserIpMap.txt. We support ANSI and UTF-8 format.

09/30/18 23:59:40:913[Error 115]: Cannot open security log for DC dc.akmlab.com - A required privilege is not held by the client.

09/30/18 23:59:41:084[ Info 1241]: New connection 127.0.0.1 : 57678.

09/30/18 23:59:41:084[ Info 1314]: Device thread 0 with 127.0.0.1 : 57678 is started.

09/30/18 23:59:41:178[ Info 3396]: Device thread 0 accept finished

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

ccapobianco — Mon, 14 Jun 2021 15:38:52 GMT

I am now receiving these same errors in my logs. All of a sudden as of yesterday, my user ID agent stopped successfully connecting to my domain controllers with the following errors:

06/14/21 10:36:35:994[ Warn 1167]: Unsupported file format for MachineIpMap.txt. We support ANSI and UTF-8 format.
06/14/21 10:36:36:103[Error 115]: Cannot open security log for DC fqdn.of.dc - The requested operation is not supported.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

BobbyHiers — Mon, 14 Jun 2021 17:42:12 GMT

We had the same problem last week. It was due to our DCs getting the June 2021 patch and our Windows based User-ID agent not having the patch yet. Once I applied the same patch to the User-ID agent server, they connected.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

ccapobianco — Mon, 14 Jun 2021 19:05:03 GMT

Thank you Bobby Hiers! Looks like the June 2021 windows patch was the culprit. I have to update my case with Palo - they should look into this with Microsoft.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

MichaelMelone — Mon, 14 Jun 2021 21:07:28 GMT

Thanks for this note. We woke up to this same issue after our DCs were patched to the June 2021 update but server running User-Id agent was not. Installing the patch on the user-id server and rebooting fixed the issue.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

P.Jacob — Tue, 15 Jun 2021 16:51:17 GMT

having the same issue, is the patch on the support software updates section? I am seeing broke version 9.1.2.9

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

ccapobianco — Tue, 15 Jun 2021 19:26:00 GMT

I don't think PA has a patch just yet, although they might. If they do, their client support rep didn't mention it to me, he only pointed me in the direction of the documentation where MS and PA recognize this issue. I am on version 10.0.0-30 of the UserID agent and the issue appeared after both member servers hosting the UID agent took the June 2021 Monthly Sec updates while the DCs that the agents communicated with did not.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

P.Jacob — Tue, 15 Jun 2021 19:29:05 GMT

I have a ticket in since this morning and it's still in queue. Can anyone confirm there is some sort of hot fix or know what the technical issue is that is causing this?

this is really a mess

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

MichaelMelone — Tue, 15 Jun 2021 23:16:00 GMT

Hi Pete,

We were able to fix this by upgrading the windows server with the 2021-06 (june) standalone update. After patch was installed and a reboot, the agent was able to connect to all of the updated domain controllers that recently got the same patch over the weekend.

Hope this helps.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

AllwynMascarenhas — Wed, 16 Jun 2021 04:35:43 GMT

wow, a random issue I faced during playing around in a lab is now exploding in the wild 2 yrs later!

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

P.Jacob — Wed, 16 Jun 2021 13:04:52 GMT

thanks for the help guys.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Vcg

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

blascola — Wed, 16 Jun 2021 13:09:09 GMT

Do you know which KB it was?

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

P.Jacob — Wed, 16 Jun 2021 13:16:43 GMT

I think it is KB5003671 but might depend on your host OS.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Vcg

I am running different OS's for my user agent servers and my DC's so I just made sure they both had the june 2012 security patches.

not sure if this whole thing was a bug or some communication I missed.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

BinTn7 — Mon, 21 Jun 2021 22:08:04 GMT

I am also having this issue. In my instance my User-ID agent server was patched with the June 2021 updates and the main data center DC's were patched which are working fine. However, our facility DC's have not been patched and I'm getting the below error.

Error: OpenEventLog failed for DC (the requested operations is not supported.

All of the DC's throwing this error are stuck in a "connecting" state.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

P.Jacob — Tue, 22 Jun 2021 01:00:27 GMT

the DC's and devices you have the user agent service on need to have that same patch loaded.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

BinTn7 — Tue, 22 Jun 2021 15:56:34 GMT

In my case I removed patch KB5003646 from the User-ID server and it resolved the issue for most but unfortunately our patch team didn't apply the patches to all DC's so it's hit or miss.

Does anyone know if the latest User-ID agent version is unaffected? I'm currently on 10.0.0-30.

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

Guillaume-A — Wed, 23 Jun 2021 14:03:17 GMT

Thanks for the KB like and the same level patch working fine for us now

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

Banumbirr — Tue, 17 Aug 2021 12:21:42 GMT

Same issue... June 2021 Patch. Do you have the KB Number ?

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

Guillaume-A — Tue, 31 Aug 2021 13:11:30 GMT

This one for me https://www.catalog.update.microsoft.com/Search.aspx?q=KB5003637

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

VinceM — Tue, 07 Sep 2021 09:38:37 GMT

Hi MichaelMelone

Can you give me more detail about the windows patch which solve your issue please ?

Rgds