ALE appears to be working but for some reason the userlog.log stopped updating after about 2 weeks. The 2 tracing logs are still updating. I did try renaming userlog.log and after restarting the service it does recreate an empty log but will no longer write to it. It seems this should continue to update since it is the log from file/view log.
ALE userlog.log stopped updating
Posted 21 March 2016 - 02:09 PM
userlog.log stores results of Examination. It is updated when you run examination.
If no examination is run, the log is not updated, it is normal.
Posted 21 March 2016 - 02:29 PM
Yes it is working after an examination. Odd I ran a few the other day and it didn't appear to update. I did check a couple to be sure.
Posted 01 April 2016 - 02:38 PM
I guess the response is a bit intermittent. I ran the examine on one account today and it would not write to the log. I ran it 4 times to be sure and yes each time it wrote to the details pane but not the log. Then I ran it on 2 other accounts that did write to the log. To be sure I even tried the right click then examine on... to select the machine it did show invalid logons to but still with this account nothing writes to the userlog.log.
Posted 01 April 2016 - 06:12 PM
In my environment the log gets updated almost immediately.
I believe a delay can occur if the service is busy with something else, but could not replicate this.
Are you experiencing any other errors, maybe slowness of operation?
And what version are you on? 4.1.417?
Version can be checked in Help - About.
Posted 04 April 2016 - 02:15 PM
I am on version 4.1.417.0 it is the free version if that matters.
I am not noticing any slowness and when it does write to the log it is quick. It is just odd that some times it doesn't write to the log. I did check again today and the one I ran 4 times never wrote to the log while a few others did. When I opened this I bet the ones I was trying for some reason didn't write to the log but on the most recent I tried a few others to make sure the log was updating. It seems odd as to why some accounts don't write to the log yet others do.
If there was a delay it would eventually write to the log but since it doesn't for some accounts I don't believe a delay is the problem.
Posted 06 April 2016 - 04:21 PM
Did you notice any regularity in writing/not writing to the log?
Is there anything similar with accounts?
Also, does the Date modified for userlog.log changes?
Also I wanted to note, that information about Examination is added to the top of the file
Posted 07 April 2016 - 02:06 PM
I ran the same account that didn't write to the log last week and it did yesterday which tells me it is not related to the specific account. The accounts are the same other than AD groups for their department. The modified date does update when it writes.
Yes the newest updates are at the top.
I wonder if the issue isn't related to the number of invalid logon attempts. Most don't have too many but some are in the hundreds. In my mind it shouldn't matter and it should still write to the log no matter how many. I am testing this since in the past we used eventcombMT which is cumbersome and only does one account at a time.