Network Event Viewer - All Release Notes

Summary: Updated internal log tail functions

In previous builds the user interface always tailed the service log file which if left open locked the file from being truncated by the service. If the user closes the Service Output window now, the user interface shuts down the tail enabling the service to truncate the log.

In previous builds if the auto refresh was turned on and the applied filter did not allow any entries to display a message box would display ever time the auto refresh ran. Unlimitedly 100s of message box would stack on top each other. The message no longer displays.

Summary: Fixed truncate now function

In previous builds the truncate now function found within the Options dialog did not apply the latest user specified rules prior to running the truncate function. This bug has been fixed.

In previous builds the truncate database table function incorrectly logged the number of entries removed from the primary table. This bug has been fixed.

In previous builds when removing the maximum downloaded log size restriction (files system only) the maximum size value would still apply if the user changed the value even when the check box was de-selected. This bug has been fixed.

In some cases a report would fail to execute or properties open. This error should have only been seen when a previous major version was installed prior to installing the latest version. This bug has been fixed.

Summary: Fixed MySQL archive table insertion bug, updated print function, and fixed several frequency detection issues

In previous builds a SQL syntax error was thrown when using MySQL, the archive option was enabled and the computer name contained a dash within the name. The SQL syntax neglected to wrap the table name with single quotes. This bug has been resolved.

The Print Current Page function has been modified to allow users the option to override the HTML template. We also added the Print Current Page command to the detail view’s popup menu.

The Save Current Page function has been modified to allow users the option to override the HTML template when exporting to HTML.

Numerous UI enhancements were made to the Save As and Email Selected Logs/Current View dialogs.

We have added a tutorial that teaches users how to print a date range of entries from the event log repository.

In previous builds on Windows Vista and Server 2008 when exporting logs users were unable to browse the local disk. This bug has been fixed.

When scheduling a report that outputs to a file, users now have the option to backup the previous report prior to running the report.

When scheduling a report that outputs to a database table, users now have the option to clear the table prior to running the report.

When scheduling a frequency detection report that outputs to a database table or downloading a log that has a frequency detection database table action assigned, the table now includes a column to store the count of messages detected within the time range. If the table was created prior to this build, the table is altered to include the count column. Current records are defaulted to null.

In previous builds when firing a message box or tray icon popup alert on behalf of a download that fires actions based on frequency detection rules, the count of entries received that matched the filter criteria was not displayed. This limitation has been resolved.

Summary: Fixed complex filter group operand issue

In previous builds users could not easily specify the logical operand (AND/OR) to apply to new complex filter criteria groups. This bug has been fixed.

In previous builds a non-fatal error was thrown when running a logon failure report when the user only configured an account logon report or the user only configured a logon report but not both. This bug has been fixed.

The selection behavior has been altered when viewing the Configured Computers or Downloaded Logs views and selecting the Syslog Configuration Wizard. If a syslog node is selected, the wizard opens with the computer or device the syslog node belongs too. If other nodes are checked, but the currently selected node is not, the checked nodes are not included within the wizard.

The tab order within the Create New Filter dialog was incorrect. This bug has been fixed.

Per a user’s request fading popup menu items is now a user settable option. To disable the fading popup menu items select Options from the Tools menu item. Select the Display tab. Select None from the ‘Popup animation’ check box.

When searching for entries on Windows Vista it was difficult to see the entry that was found. The list view focused color has been alerted to use a lighter shade of the highlighted color.

In previous builds the tray icon had a one minute delay built in as a work around for a startup issue rarely seen on Windows Vista. We believe we have resolved the issue and have therefore removed the startup delay.

In previous builds the installation did not automatically install the platform dependent .Net 2.0 Framework on I64 and X64 computers that did not already have the prerequisite installed. The installation has been modified to, if necessary, download the prerequisites from Microsoft and install them.

Summary: Added several minor UI enhancements

In previous builds when switching between displayed log views, the message, data, and notes windows did not update properly. This bug has been resolved.

We have added an option to the Options dialog to hide the newly displaying filter prompt dialog when viewing an event log.

From any of the detail list views, pressing Ctrl-A now selects all items.

Several UI enhancements were made to reduce drawing flicker and more appropriately update the mouse cursor.

Summary: Added failed logon reports

Users can now create failed logon reports on-demand or per a configured schedule.

In previous builds when pressing the left arrow while viewing a sub-group within a log view an object reference error was thrown. This bug has been fixed.

Users can now manually specify a device’s IP address from within the Syslog Configuration Wizard.

Users can now map computers from within the Configuration Wizard.

Users can now display the Active Directory Auto Configurator via a menu item under the Tools menu item.

Users can now create, modify and delete filters from the Consolidation tab within the Configuration Wizard.

Fixed a potential temporary file leak when sending HTML formatted emails.

In recent builds the configuration template save and load buttons were not visible until after the user resized the Configuration Wizard dialog. The buttons have been moved to a location that is visible when the dialog is at its minimum allowed or default size.

Summary: Added WMI service dependency

When rebooting a Server 2003 machine, the service would fail to start when the service was configured to forward internal messages to a syslog server. The failure occurs when the Windows Management Instrumentation (WMI) service has not yet started. The installation has been updated to install the service with a dependency on WMI. If the software was previously installed, you must uninstall and then re-install for this change to take effect.

Added help to the search dialog and simple filter criteria dialog for event ID and/or/range rules.

In previous builds an object reference error was through when a real-time monitor was configured to send a HTML formatted email message in response to no entries being received that passed the assigned filter within a time period.

Summary: Added maximum entry count to email notifications

In previous builds many users created email notifications and reports that applied very broad filter criteria causing huge emails to be sent. In many cases the emails were so large the email function failed due to a lack of memory. The email functions now limit the number of entries to 2000. Please let us know if 2000 is too limiting and we will consider adding this value as an option.

All scheduled routines can now be disabled on specific days of the week.

Summary: Added several tutorials and updated frequency detection reports

We have added an extensive tutorial that walks users through different consolidation configurations and archive procedures.

In previous builds when loading an auxiliary data source the archive tree nodes within the Downloaded Logs view did not display. This bug has been fixed.

In previous builds when a user added an auxiliary data source or changed an already configured auxiliary data source, if the user did not click the Apply button the Options dialog would close without prompting the user to save the changes. The Options dialog now prompts the user to save the changes.

When sending HTML emails and exporting to HTML, the event type and log name now colored. Information is blue, warning is orange, error is red, success audit is green, failure audit is red, application log is dark green, system log is dark blue, and security log is dark red.

In previous builds frequency detection reports only allowed users to see entries that occurred more than once within the time period. This was a problem when, for example, the administrator wanted to see the total count of a particular entry per day. If the entry only appeared once, the frequency detection report did not include the entry within the report. The Report Wizard has been modified to allow users to specify more than 0 times per unit of time. When 0 is specified any instance of the entry causes the frequency detection report to display the entry.

The Filters dialog now allows users to copy a filter to a new filter.

In previous builds the toolbar and menu bar items did not properly enable in a few very specific instances. These bugs have been fixed.

We have added a tutorial that explains how to create a daily report that contains a count of specific entries. This tutorial shows, for example, how a user can receive a daily email that lists the number of times a service was started the previous day.

When exporting the current view to a file, users are now prompted to automatically open the new file.

Users can now display downloaded log entries and log properties when right clicking on a download log status item from within the System Status view.

Users can now create a view from a current merge. Simply right click within the detail view and select Save As View.

In previous builds when right clicking within the Downloaded Logs or Reports and Views view on a tree node the popup menu item would flicker. The popup menu item no longer flickers.

In previous builds when viewing event log entries via the Filter Action Events (events that passed assigned filter criteria during a download) the current event type filters and selected filter were applied (toolbar event type toggles and filters combo box). Network Event Viewer now sets all the event type filters and clears the selected filter enabling all entries selected within the checked Filter Action Events nodes to display as expected.

In previous builds users would receive an object reference error when attempting to download logs from a lower cased mapped computer within the Network view. This bug has been fixed.

The map computer dialog no longer allows users to see the assigned password.

Summary: Added consolidation filters

In previous builds when downloading event log entries all entries were saved to the data repository. Users can now apply a consolidation filter that limits the saved entries to those that pass the assigned filter. Use the Configuration Wizard to apply a consolidation filter. Please note, while making changes to the Configuration Wizard some of the icons and layout were modified.

The configuration templates did not save download filters and actions or any of the real-time parameters. The templates have been updated to save these parameters.

The Active Directory Auto Configurator did not skip computers listed in the exclusion list. This bug has been fixed.

Users can create a new action based on a current action. From the Actions Manager select the action to base the new action on and then click Copy.

The action configuration dialogs have been moved from the application library to our Corner Bowl Software common library enabling code reuse between all our applications. Please note there are several minor user interface differences.

We have boosted the syslog forward action performance. Previously the UDP socket was recreated for every entry forwarded. The UDP socket is now cached.

When storing logs using MySQL there in some cases the archive function threw an error causing the archive to fail. This bug has been fixed.

The export to CSV had a bug in it that caused the log name to appear twice which shifted the column content from the column headers. This bug has been fixed.

When sending email alerts in response to entries passing filter criteria during a download the text emails (non-HTML) did not use the user configured settings. Instead a hard coded format was used. This bug has been fixed.

Summary: Events can now be automatically added to a filter

Users can now quickly add an event to a filter with just a few clicks of the mouse. To add an entry to a filter, right click on an event log entry and select Filter Selected Event. Once the Filter Selected Event dialog is loaded, specify if you want to show or hide the event in question. Select if you want to create a new filter or append the criteria to an existing filter. If creating a new filter, specify if you want to create a simple or complex filter. Finally, choose if you want to create the filter and apply the new filter to the current view, create the filter and review the criteria within the Filters dialog, or create the filter without applying the filter to the current view.

When creating simple filters users can now specify multiple event IDs by separating each event ID with a comma. A range can be specified by separating the values with a dash. For example, 100,200,300-400.

The email and HTML templates have been modified to include a footer that includes the name and location the of software that generated the document.

In previous builds filter criteria time values were displayed in US locale format. All filter criteria time fields are now displayed in the current locale.

In previous builds when importing a configuration to a system that uses a different locale than the system that generated the configuration, the filters did not import properly. This bug has been fixed.

Users now have the capability to suppress alerts and actions. Users configure alert and action suppression via the Configuration Wizard or Syslog Configuration Wizard. Once configured, the service will assign an alert flag to the real-time monitor upon an entry passing assigned filter criteria. Once the alert flag is set, filtered entries are ignored until the flag is cleared. The user can configure the alert flag to automatically clear after a period of time, for example after an hour, or the user can manually clear the flag via the user interface. Once cleared the next entry that passes the real-time monitor’s filter criteria will fire.

Users can now specify to exclude weekends when scheduling downloads and reports.

When creating new complex filter criteria, the user specified DateTime control associated with time criteria would show the current date and time. The behavior has been changed so the current date is shown but the time is set to 12:00 AM.

Summary: Added System Status and Syslog Viewer startup options

Users can now configure the user interface to optionally hide the System Status window at startup as well as automatically show the Syslog Viewer window at startup. To set these options select Options from the Tools menu item. Select the Display tab. Use the Display tab on the Options dialog to set these options. The options are listed under the Startup section.

The Top Events tab within the Log Properties Dialog now creates a graphical representation of the tabular output. Note that events less than 5% of the total report results are grouped together.

When an empty top events query was returned from the Log Properties dialog there was no indicator the query returned an empty result set. A message is now displayed.

The top events query did not properly execute the Last X Hours query. This bug has been fixed.

The Log Properties had a bad link to the help file. This bug has been fixed.

A real-time monitor tutorial was added to the help file.

The SQL Server tutorial has been replaced with a new tutorial that targets SQL Server 2005.

In previous builds the Filters toolbar combo box was not updated after closing the Report and View Wizard. If the user added a new filter or removed an old filter the changes would not reflect in the Filters toolbar combo box. This bug has been fixed.

In rare cases when adding a computer to a report or view via the Report and View Wizard the same computer name may have appeared once in lower case and again in upper case. This bug has been fixed.

When configuring a single computer within the Configuration Wizard, the domain combo box had no effect on the login credentials. This bug has been fixed.

In previous builds when changing the event log repository type (for example from file system to MySQL) the Mapped Computers tree node within the Network View was permanently deleted from the view. This bug has been fixed.

The Configuration Wizard now enables users to select and de-select all the logs displayed within the Logs tab.

In previous builds when adding a filter from within the Configuration Wizard or Syslog Configuration Wizard new filters were not automatically assigned and/or selected when the user clicked the Select button from within the Filters dialog box. The filter is now automatically assigned if not already assigned. Once assigned the filter is selected within the assigned filters list box.

In previous builds When configuring multiple computers and checking or un-checking a log from the logs list box, the wizard may not have prompted the user to save their changes. This bug has been fixed.

In previous builds when an invalid syslog packet was received the error message written to the service log did not include the message received. The behavior has been modified to include the data. This modification will help us identify alternate syslog message formats in use.

When using MySQL to consolidate logs, if the user interface initially loaded with the Reports and Views navigation window item selected, and the user opened the Reports and Views wizard, the wizard would attempt to connect to SQL Server instead of MySQL when retrieving a list of available logs. This bug has been fixed.

Summary: Fixed several localization bugs

Both the Output view and Service Output view did not display application log entries when run on specific locales. For example, when run on Italian operating systems both the Output view and Service view would remain empty thought out execution time.

From the Report and View Wizard, when browsing for the file to save a report to or the HTML template to apply, the save as dialog did not automatically navigate to the location of the current setting. This bug has been fixed.

When clicking the Restore Defaults button on the Actions tab of the Report and View Wizard, the Email and HTML output template was not updated. This bug has been fixed.

Summary: Added Unicode support for file based event log repositories

This build includes an email limiter or spam control. To configure the email limiter select Options from the Tools menu item. From the Mail Connection tab, enable the email limiter and specify the maximum number of emails to fire and the period to apply the rules.

In previous builds Network Event Viewer did not support Unicode operating systems when consolidating logs using the file system. This limitation has been resolved. Please note when upgrading the Filter Action Events view will be empty as the format of the file has changed. This view will automatically rebuild over time.

In previous builds all non-user interface actions were saved to a file called ‘alerts7009’. This file is used by the tray icon to fire user interface alerts. Non-user interface actions were previously added to this file so we could someday add a user interface component that showed all actions fired. Since this functionality already exists in the filter action events log we decided to remove this functionality from the alerts file possibly significantly decreasing the alerts file size which in turn decreases the CPU foot print when the tray icon starts up.

Message box alerts can now be minimized enabling users to look at previous alerts at any time. A menu item has also been added to the tray icon popup menu to enable users to re-open the message box alert dialog after it has been closed.

Users can now start a process or a batch file when an entry passes filter criteria.

Summary: Fixed minor configuration deletion bug

When attempting to delete a configuration and the logical group is checked, at least one computer under the logical group is not checked, and at least one computer under the logical group is checked an error was thrown. This bug has been fixed.

Summary: Made several server performance enhancements

The download algorithm sorts entries prior to committing them to the log repository. When downloading logs to a database and no filters are assigned to the download configuration, there is no need to sort the entries prior to committing them to the database. In this scenario, the algorithm has been modified to bypass the sort. Users should now see significant performance gains when downloading large logs to a database and there are no download filters assigned.

In previous builds there was no way to assign a non-standard port to the MySQL configuration. Users can now specify the port to connect by appending “:1234” to the end of the host name.

In previous builds the popup menu re-displayed after deleting a log from the Downloaded Logs view. The popup menu no longer re-displays.

When viewing the Filter Actions Events or Reports and Views tabs within the Navigation window, users may have seen a cast error thrown when attempting to open the Syslog Configuration Wizard. This bug has been fixed.

In prior builds the MySQL archive function might have failed throwing the following error: Duplicate entry ‘X’ for key 1. This bug has been fixed.

In previous builds users would see an object reference error thrown when attempting to delete a filter when a report was configured without any filter specified. This bug has been fixed.

When creating a standard report, users can now include and tags within the filename.

In previous builds the View and Delete buttons on the File tab within the Actions tab within the Report Wizard did nothing. These bugs have been fixed.

Summary: Fixed service tasking issues on delayed startup

In previous builds if the system administrator turned off the application service or the actual computer for a prolonged period of time, upon reboot the service could over task the system while attempting to run overdue scheduled tasks. The service now re-calculates each overdue task using the current time. The end result is that the service is able to start without over tasking the system. Each task is pushed out to the next scheduled time.

When scheduled a task, the schedule control always calculated the next time to execute using the last time (if the task had previously executed). If the current time minus the last time was longer than the schedule interval, the current time was displayed and used to schedule the next time the service should run the task. The control has been updated to re-calculate the next task execution time using the current time as the last time.

In previous builds if the service was configured to forward internally generated messages to a syslog server and the service was unable to bind a client UDP port during startup, the service may have failed to start. This bug has been fixed.

The domain and logical group combo-boxes on the Configuration Wizard now have auto-complete turned on.

In previous builds users could manually advance the tab position within the Configuration Wizard and the Reports and Views Wizard by-passing some of the tab page validation routines. These bugs have been fixed.

Updated the dialog icon displayed in Reports and Views Wizard to match the icon displayed within the Reports and Views tab within the Navigation window.

When opening the Actions Manager for a CSV file export, the HTML template control remained enabled. The control is now properly disabled.

The items within the list controls on the Actions tab of the Configuration Wizard and the Filters tab of the Report and View Wizard are now sorted alphabetically.

In previous builds when downloading logs there was an option to limit local memory utilization in favor of remote CPU load. This option put the entry sorting load onto the remote computer. The new Windows 2008 and Windows Vista operating systems return the event log entries in the reverse order of Windows XP and 2000. The new order is oldest to latest. This format would require NEV to download the entire log file every time and then sort the entries in memory anyway negating the memory performance enhancements previously gained. This option is no longer available.

Summary: Added database export option to reports

Reports can now be exported to a user defined database table.

The viewer now optionally displays the log name with color. The application log name is displayed in green, the system log name is displayed in blue, and the security log name is displayed in red. To display the log names in black, select Options from the Tools menu item. Select the Display tab. Lastly, de-select the ‘Display log names using color’ option.

A toolbar button has been added to the log view toolbar for message preview. If you change the option within the log view, the global settings are not changed. If you change the message preview option via the View menu item, the change is global.

We have added the ability to display summary charts when firing emails or exporting to HTML. For detailed information, please search on Email and HTML Templates within the help file.

The code that enables and disables toolbar buttons and menu bar items has been updated so commands that apply to a window are only enabled when the window has the appropriate focus.

When separating email addresses with a semicolon followed by a space, the email function would attempt to send an email to an empty address. This bug has been fixed.

If an entry contained more than 4 KBs of data and a syslog action was executed, the packet was dropped. The code has been changed to truncate the message to the maximum UDP packet size allowed.

Summary: Significant build with many new features and bug fixes

In previous builds users configured syslog filters and actions via the event log Configuration Wizard. For ease of use syslog configuration has been removed from the Configuration Wizard and moved to its own wizard. To configure syslog monitoring, highlight the device that contains the syslog from the Downloaded Logs view. Right click and select Syslog Configuration Wizard.

In previous builds the syslog server was only optimized for database consolidation. When using the file system to store consolidated logs and the server received a significant number of syslog messages from the same device, the CPU could easily get bogged down writing the new entry to the file system. The format of the file has been modified to allow for fast file appending. This new format may however slow down access to the entries within the viewer.

When using the file system to store logs, the initial download of a log would write as many days of entries as defined in the initial download option and ignore the maximum number of days to store (if set) possibly causing the initial download to store more days than configured if the initial maximum days exceeded the maximum number of days to store. The file system download has been updated to work the same way downloads to database work which is to limit the download to the configured initial maximum number of days to download but also limit the storage to the maximum number of days to store.

The Report Wizard now automatically selects the installed frequency detection HTML and email template when a frequency detection report is created.

In previous builds when changing a report name within the Report Wizard the original report was not modified but instead a new report was created. Also, if the new name already existed, the report that had the same name was overwritten. These bugs have been fixed.

We have added the tag to enable users to display all entries that pass filter criteria to the message box alert.

The tag used to show both the date and time. We have added the tag and now the tag only shows the time and the tag shows the date. Please update your actions accordingly.

In previous builds if a user logged in and numerous user interface action were pending they would display continually at login. When 10s or hundreds of actions were pending, this format was less than ideal. If more than 10 actions are pending execution upon user login, the actions are now dumped enabling the user to login without countless actions being fired. Please note the tray icon still displays the red exclamation notifying the user events have passed filter criteria and are pending review.

The default message for message box actions has been changed to include all entries that pass filter criteria. We have also added the ability for users to set the message box font, font color, and background color. The message box also now resizes. Please note if you have already configured a message box action your message content configuration will not be modified.

In previous builds the real-time syslog viewer would stop displaying messages once 1000 messages were received and the user changed the default column sort or sort direction. This bug has been fixed.

We have added the ability for users to permanently disable the tray icon from within the user interface. To permanently disable the tray icon, select Options from the Tools menu item. Select the Display tab. Under the Tray Icon heading, check Disable tray icon.

The real-time tab within the Report Wizard now displays all selected filter names above the frequency detection configuration section.

The help file has been updated to include information on the new features added.

In previous builds if the application that fired an event log entry did not properly implement event log resource DLLs, the Windows Event Viewer would return a message that noted the application bug and include the message replacement strings. Network Event Viewer did not show these replacements strings. The export to file and application display now mimics the OS response to applications that do not properly interface with the OS. Please note, the Network Event Viewer event log repository has stored the replacement strings since version 2007 enabling export to EVT file format.

We added a dialog to distribute download schedules evenly over a configurable period of time. The dialog is accessed via the Configuration Wizard. Please see the help for more information.

The service log view now offers filter capability. To view this new functionality, select Service Log from the View menu item.

The Log Properties dialog now includes a button to view service history. When clicked, the service log is opened and a regular expression filter automatically applied to filter out all entries that do not pertain to the configured log.

In previous builds when creating a frequency detection report with multiple filters assigned, the selected filters header within the Filters tab did not list all selected filters. This bug has been fixed.

Added a MySQL tutorial to the help file.

Summary: Added multiple data source support

Added multiple data source support called auxiliary data sources. Auxiliary data sources enable system administrators to view and report on logs consolidated by other installations of Network Event Viewer. This scenario is typically used when an instance of Network Event Viewer is installed at a remote location, such as a field office or branch, and that installation pushes log files to a central location such as the corporate headquarters. To setup multiple data sources select Options from the Tools menu item. Select the last tab called Auxiliary Data Sources. From this tab you can configure each auxiliary data source.

In previous builds if a computer was offline and you attempted to view the consolidated logs properties, the dialog would throw an RPC error and close. The error is still thrown, however; the dialog now remains open enabling administrators to view the Downloaded Log and Top Events tabs.

In previous builds if attempting to clear remote logs via the Downloaded Logs view and the server in question is offline no error was thrown. Depending if a single computer or multiple computers are selected an error is either thrown to a message box or to the output window.

In previous builds when consolidating to the file system rather than a database all entries that passed filter criteria during a download were saved to a file called fae7009 located in the common application data directory rather than within the output directory. If the environment has multiple installations of Network Event Viewer installed all pointing to the same location on the network to store and read consolidated logs, each installation would only be able to see the events that passed its own download filters. The behavior has been changed to match the behavior seen when using a database to store consolidated logs. Please note the previous file is not visible by default. If you must view the previous file, stop the service, close the user interface, move the fae7009 file to the output directory and then rename it to fae80018. If the file already exists, that means a download has already occurred and entries passed filter criteria causing the new file to be created.

Summary: Added 2 HTML template files that support frequency detection

We added 2 HTML template files that support frequency detection. The templates include an extra column named Count. This column contains the count of entries that pass the filter criteria. The template files are called report_frequency_detection.html and filter_frequency_detection.html. This files are used for scheduled frequency detection reports and real-time monitors that apply frequency detection rules. The files are located in the installation directory under the HtmlTemplates sub-directory. The default location is: C:\Program Files\Network Event Viewer\HtmlTemplates. To use the report template, specify the report_frequency_detection.html file within the Report Wizard. To use the filter template create a new Email or HTML export action via the Actions Manager that points to the filter_frequency_detection.html template. Lastly, assign the action to your frequency detection rules within the Configuration Wizard.

When adding new filters within the Configuration Wizard, the Actions and Real-Time tab did not always refresh the available filters. This bug has been fixed.

A non-fatal error was sometimes displayed in the Output window when opening the Filters dialog. This bug has been fixed.

Summary: Increased maximum database timeout values

Numerous users within large environments have been getting timeout errors. In response to this issue we have increased the maximum database connection and command timeout values. In previous builds the maximum database connection timeout value was 2 minutes and maximum command timeout value was 5 minutes. The maximum connection timeout has been increased to 20 minutes and the default value changed from 15 seconds to 30 seconds. The maximum command timeout has been increased to 1 hour and the default value changed from 30 seconds to 5 minutes.

When viewing a log’s properties via the Properties menu item the Apply button would not enable if the user manually typed a value into the maximum log size spin control. This bug has been fixed.

Summary: Added frequency detection reports

This build includes a new report type that enables users to create frequency reports. Users assign multiple filters to a report and then set frequency detection variables to each filter enabling reports such as the number of times a particular user logged on for the last 24 hours.

The and tags available within actions displayed each other’s entry when executed post download or via a scheduled report. This bug has been fixed.

When opening the report wizard from the popup menu, upon closing the wizard the popup menu would sometimes re-display. This bug has been fixed.

The Download Now menu item is enabled when the Reports and Views view is selected and focus is contained within a detail document. In previous builds, if the user clicked the Download button an error was thrown. This bug has been fixed.

Summary: Fixed less than frequency detection bug

The less than frequency detection failed to work when no event entries were received that passed the assigned filter criteria.

Made several minor changes to the help file.

The Mail Connection page within the Options dialog now allows users to send a test email message.

Build 8.0.0.13

Summary: Added frequency detection functionality

Added frequency detection support to download schedules as well as real time monitors enabling administrators to receive notification when an event fails to fire within a specified frequency or fires more often than expected.

On some systems, the service was unable to real-time monitor the local security log file. This bug has been fixed.

When viewing a log, if you delete the downloaded log from the Downloaded Logs view, the log view displayed (null) under the log column. This bug has been fixed.

When receiving syslog messages from routers or other devices that do not have host names associated with them and when using MySQL to consolidate logs, Network Event Viewer attempted to use the IP address within the table name. This bug has been fixed.

Summary: Fixed clear event log and several syslog bugs

When configured to backup previously downloaded log files and the syslog server was running, a file was created for each syslog messages received. The behavior has been changed so entries are pre-pended.

When configured to overwrite previously downloaded log files and the syslog server was running, the syslog file would only contain the last entry. The behavior has been changed so entries are pre-pended.

On Windows Vista, when double-clicking on the tray icon, an error would display if the operating system was unable to start the application. This bug has been fixed.

The clear function did not always work when clearing the local event logs. This bug has been fixed.

The scheduler was updated to include exclusion periods for minute based schedules.

Fixed forward and backward clock issues.

In previous builds, when syslogging to the localhost, the application syslog messages did not correctly bind to the local adapter. This bug has been fixed.

Summary: Added print support and optimized filter action events log repository

Added the ability to print the current page. Network Event Viewer uses the ‘view.html’ template to produce a temporary HTML file. This file is then opened using the program associated with HTML documents. Users can create their own custom template that includes their corporate look and feel as well as which columns to print.

The Filter Action Events view contains a list of all entries that passed assigned filter criteria during a log download. Many users are now exporting all entries to EVT file format using empty filters. In previous builds, if a filter was empty, all entries were duplicated in the filter action events log repository. The behavior has been changed so entries are only written to the filter action events log repository when the filter has criteria assigned (in other words it’s not empty).

When consolidating to the file system, if a log contained multiple identical entries, the user could not set the flag or notes for any duplicate entry other than the first entry found in the log repository. This bug has been mostly fixed. If you open the user interface, display the log, allow the service to download new entries, then attempt to set an entry other than the first entry found, the first entry is still set.

In previous builds actions might fail if the actions data file was empty. This bug has been fixed.

The clear function used an old internal .Net API. The function has been updated to use WMI when appropriate.

When refreshing the Network view, the mapped computers node was removed from the view. This bug has been fixed.

The database, file export, and email actions did not log user friendly message upon failure. These bugs have been fixed.

Summary: Added auto-backup when exporting to file after a download

File export actions applied to scheduled downloads now optionally automatically backups previously created files to a sub-directory called backup.

In previous builds the export to EVT did not create the output directory if it did not exist. This bug has been fixed.

When a user selected to display the report from the Report Wizard the report was not automatically displayed. This bug has been fixed.

We recently learned users were creating empty filters and applying them to all downloads so they could create EVT file backups. The software saves all passed entries to an alerts file. This functionality was for 2 reasons. First, it was added so user interface alerts could display the events that passed the filter criteria. Second, it was created so some time in the future we could see the history of the alerts and their contents. Since this format is file based and the software already saved all entries to the filter action events table or file this functionally does not add much value. The software has been modified so events are added only when a user interface action is assigned.

When multiple actions were applied to the same download configuration, each entry that passed the filter was added to the filter action events table or file once for each action. This bug has been fixed.

If a user deleted all the Filter Action Events entries, the next time entries were appended to the log a non-fatal error was thrown while attempting to truncate the log. This bug has been fixed.

Summary: Fixed object reference error

If an action was removed but still assigned to a download configuration, an object reference error was thrown during download and when closing the Configuration wizard. This bug has been fixed.

Summary: Added real-time monitoring

Administrators can now monitor event logs in real-time.

In previous builds logical groups in the Configured Computers view were always expanded. When creating multiple logical groups with many computers, this view format was cumbersome. The behavior has been changed so the view is only expanded if a single logical group exists.

The Actions Wizard did not save the vertical resize bar location. This bug has been fixed.

The Actions Wizard now supports selecting and deleting multiple actions at the same time.

In previous builds the message box action did now force the message box to the top of the window order. This bug has been fixed.

In previous builds viewing the Properties Dialog for an available syslog caused an error to be thrown and the dialog would immediately close. This bug has been fixed.

In previous builds administrators were unable to set the remote log properties via the Properties Dialog due to a code obfuscation bug. This bug has been fixed.

The help file was updated to reflect changes made since the previous build of the help file.

Summary: Fixed complex filter bugs

When creating a complex time based filter users would receive an error when applying a type other than a custom time. Users were also not able to see updates when applying a custom time. These bugs have been fixed.

The syslog server logged received entries to a file so the viewer could easily display the received entries. This file was never truncated. The behavior has been changed so the file is only written to when the viewer is open. When the viewer closes, the file is now deleted.

Summary: Fixed several performance issues

Currently all alerts are logged to a binary file for future display of historical alerts. By default all alerts and entries associated with the alerts were saved for 90 days. The nevti (tray icon) executable loads this file during startup to fire all alerts that occurred while the primary user was logged off. Currently there is no way to set this value other than manually setting a registry entry. The application has been updated to default this value to 3 days.

The Display Logs popup menu item did not always enable or disable correctly. This bug has been fixed.

The service did not truncate the syslog log files when entries were received. The service has been updated to truncate the syslog log files once an hour.

Summary: Fixed MySQL bug

In previous builds, messages that contained a slanted ' could not be written. This bug has been fixed.

Summary: Added auto advance and made several updates to the Log Properties dialog

When displaying logs in previous builds, if no entries were found on the first page, the viewer did not automatically move to the next page. We have added an auto advance option which automatically searches each page until an entry that matches the current filter criteria is found.

In previous builds users did not have the ability to quickly advance to a specific page. Users can now select a date they wish to view. Once selected the viewer displays the page that contains the selected date.

Added a Downloaded Log tab to Log Properties dialog.

Added a Top Events tab to the Log Properties dialog that enables users to query the log for the top x number of unique events.

When highlighting a log in the Downloaded Logs view in previous builds, the log was automatically displayed. This was an annoyance when users wanted to view the Log Properties dialog or execute another function available via the right click popup menu. The behavior has been changed to display the popup menu immediately after the user highlights the log. A new menu item was added to the top of the popup menu enabling the user to display the log.

Users can now create time based filters enabling messages that are received during maintenance hours to be ignored.

Users can now create filters that limit results to a specified number of hours prior to the current time.

Fixed a syslog server error when the service was syslogging its own messages, the syslog server was on, and the connection to the database could not be made.

In previous builds, the Find toolbar item was enabled when no merges were displayed. This bug has been fixed.

When using MySQL, if the service was unable to connect to the database, an error was written to the log stating and exception was thrown rather than including the error message sent by the MySQL data access library. This bug has been fixed.

The message box alert maintains alert history. In previous builds the list was never truncated causing memory to leak. This bug has been fixed.

Summary: Added database archive solution

Network Event Viewer now supports archiving entries to a secondary event log database table when using a database to consolidate logs.

Updated the help file to include information on archiving and updated syslog section to better explain how to monitor syslog messages. Also made several minor changes to the help file.

In previous builds, when adding a filter via the Configuration Wizard or the Report Wizard, if the user clicked the Close button on the Filters dialog, any new filters added were not inserted into the available filters list. This bug has been fixed. Also, now if the user clicks the Select button from the Filters dialog, the filter is automatically selected in both wizards.

In previous builds, the status window would display a bogus time if the configuration computer’s logs had not yet been downloaded. This bug has been fixed.

Summary: Removed DNS lookup for IP addresses

When downloading logs, a DNS lookup is run to minimize timeouts for off line computers. When IP addresses are mapped, the DNS lookup may fail causing the download to fail. The download function no longer runs DNS lookups for IP addresses.

Uses can now backup the software configuration to file. To backup, select Export Configuration from the Tools menu item. To import, select Import Configuration from the Tools menu item. Please note, the current configuration is deleted prior to the application of the saved configuration.

Summary: Updated system status window

Double-clicking log in status window now displays the downloaded event log file.

When the mouse hovered over a status window item, the item became underlined, however; clicking on the items did nothing. Most of the items listed now take the user to a specific configuration dialog.

In previous builds, the system status window did not reflect changes made from the options dialog until after the system status windows was re-opened. This limitation has been resolved.

Users can now rename logical groups from the Downloaded logs view.

In previous builds, the syslog server did not immediately start when the service was restarted. The syslog server is now immediately started.

In previous builds, the Change Service Login wizard did not permit the user to clear the assigned account to run the service under the Local System account. This bug has been fixed.

Summary: Added host and path support to AD connection dialog

Several changes were made to the Active Directory connection dialog as well as the code that creates the query string enabling support for connection strings that contain the actual hostname and port the LDAP server resides.

In previous builds, users could not use email servers such as gmail because they require a SSL connection. SSL support has now been added to the email client.

The remote log properties dialog was updated to include download now and view now buttons.

The Active Directory Auto Configuration dialog did not resize properly. This bug has been fixed.

When storing logs to the file system, the size field in the File System Status window in the System Status form did not include archived logs found in sub-directories. This bug has been fixed.

The Active Directory auto configuration was only able to monitor nodes directly under the root. This bug has been fixed.

Previously, the Auto Configurator did not have a method to assign login credentials. The Active Directory configuration dialog now includes an optional domain field for specifying the login account. When configuring new computers, the Auto Configurator assigns the account information assigned to the Active Directory configuration.

The Configuration Wizard includes a new tab for specifying an alternate account to use when downloading logs. This functionality enables users to select a set of computers and update the account information all at once.

Impersonated calls to WMI did not include domain information. This bug may have incorrectly caused access denied errors when connecting to computers on another domain. This bug has been fixed.

The HTML templates have been updated.

The export to EVT would fail if a user specified in a log entry could not be resolved. This bug has been fixed.

The Report wizard did not validate the output file extension. This bug has been fixed.

When the service failed to download or save an event log, a download error was written to the nev.log file, however the host name and event log name were not included in the message. The log message now contains this information.

Summary: Fixed syslog viewer tab bug

The syslog viewer would not display entries that contained tabs in the message. This bug has been fixed.

Increased the optional maximum size of the file system based cached logs from 5 MBs to 20 MBs.

Summary: Applied WMI API to log discovery

Available event logs were previously discovered using a .Net API even when the WMI API was selected. This bug has been fixed.

The default database command timeout has been increased from 30 seconds to 2 minutes.

The Actions Manager form now enables users to resize the list of configured alerts.

The output and service output windows have been updated to use a control that automatically wraps message text.

Added New Logical Group toolbar button.

Updated Configure Actions icon and added toolbar button.

When using the up and down button in the Entry Form, focus would switch to the viewer. Focus now remains in the Entry Form.

In previous build if a user dragged a syslog viewer column header and dropped the header anywhere other than on top the list view header, the column was lost. This bug has been fixed.

When a sub-tree item in the Network view tree was selected and the parent was then collapsed, the parent would immediately expand. This bug has been fixed.

Summary: Fixed fatal Configuration Wizard bug

A fatal error was thrown when configuring a new computer and not specifying a logical group. This bug has been fixed.

The list item icons in the detail view all displayed one pixel too low. This bug has been fixed.

Summary: Fixed syslog DNS lookup bug

When the syslog server received a message from a device that did not have a hostname associated with it, an error was thrown and the message was not saved. The server now uses the IP address in place of a hostname.

The Configured Computers tree view did not sort the logical groups. This bug has been fixed.

The Actions Manager dialog did not sort the actions. This bug has been fixed.

The Configuration Wizard did not sort the available and assigned filters and actions. This bug has been fixed.

Summary: Updated help file and type icons

The help file was updated to reflect many of the recent enhancements.

Updated the type icons displayed in the toolbar and merge view.

When clearing a filter, sometimes the type filter would clear as well causing nothing to display. This bug has been fixed.

Summary: Added tree view scrolling while dragging and dropping.

When many computers were listed in the Configured Computers view, there was no way to drag and drop a computer to a logical group that was not currently displayed on the screen. The nodes in the tree view now scroll when dragging to a logical group that is not currently displayed.

Users can now assign computers to a logical group from the Configuration Wizard.

Updated the 3rd party menu bar, toolbar, and docking windows controls to build 2.0.0.94.

Summary: Fixed maintenance installation bug

When making some installation changes for Windows Vista, a maintenance installation bug was introduced that caused some maintenance installations to fail. This bug has been fixed.

Summary: Fixed several minor usability issues and bugs

Modified the help contents of the Intro tab of the Configuration Wizard.

Added tool tips to the filters and actions buttons on the Actions tab of the Configuration Wizard.

Modified the help contents of the Intro tab of the Report and View Wizard.

Modified the Verify tab of the Report and View Wizard to more clearly explain that actions are only executed when a report is run from the Windows Service on behalf of an enabled schedule.

When discovering logs, some computers return a registry access denied error. The UI now automatically displays the Map Computer dialog enabling credentials to be assigned.

When displaying a report or view in the UI, if you cleared the filter, all type filters were also cleared. This bug has been fixed.

Summary: Fixed update and un-installation custom action failure.

On certain systems update installations and un-installations would fail due to a system library missing. This bug has been fixed.

On some systems the selected or focused System Status list item was difficult to read. This bug has been fixed.

We made some minor changes to the syslog server status to more accurately display the status.

Rarely the menu bar, toolbars, and navigation window would disappear. We have been unable to duplicate the problem, however; we have added some code to ensure the menu item, toolbars, and navigation window always displays at startup.

Summary: Fixed local security log download bug

On certain machines, Network Event Viewer was unable to download the local security log file. This bug has been fixed.

Summary: Added transaction support to the download algorithm

If the system was shutdown while a download was running and using a database to consolidate logs, entries not already downloaded and saved would not be consolidated. To fix this bug we have added transaction support to our download algorithm.

If the consolidation database ran out of space and entries existed outside the maximum number of days to store, the download would still fail. This occurred because the truncate function was always executed after the download. Since the download failed, the truncate function was never run. The behavior has been change so the truncate function is now run first freeing up space for the next download.

If the consolidation database ran out of space there was no way to decrease the maximum number of days and then manually truncate the database. The Options dialog now includes a button to allow users to manually truncate the database to a specific number of days.

If a user sets type filters (info, warning, critical, etc.) in the viewer and then sets and clears a filter, the type filters remain set. This may be problematic when viewing large logs. The user would have to remember to set the type filters back the way they wanted them before they cleared the filter. The behavior has been changed to the viewer remembers the type filters selected prior to selecting a filter. When the filter is cleared, type filters are then set back to the values prior to the filter being set.

The merge information window above the viewer used to always contain every log that was initially selected in the merge. Now if the user deselects one of the log toolbar buttons after a merge, the merge information contents are updated so that log name no longer appears in the merge information window.

The manual export logs to file function did not allow users to define the filename. Users can now specify 4 different tags to help create automatic filenames that make sense to the user. The tags are , , , and .

There are many different type of access exceptions that get thrown when discovering logs and downloading log contents. The viewer handles some of these exceptions and when appropriate offers the user the option to map credentials to the computer. Several more access exceptions are now handled.

The Configuration Wizard would enable users to create a configuration without any logs selected. This bug has been fixed.

Summary: Fixed application hang

When downloading entries the service or user interface would hang if attempting to truncate the filtered action events log.

The application would sometimes display a window (that you could not close) in the taskbar or on the desktop when a message box action was fired immediately following a user login. A delay of one minute has been added so this Windows bug is hopefully avoided.

Summary: Enhanced complex filter dialog

Added move up and move down functionality to the complex filter dialog.

Users can now convert simple filters to complex filters.

The simple filter criteria dialog now includes a combo box to filter events based on the flag, flag complete, or no flag.

Added action column which shows a red exclamation point if the entry passed an assigned filter when it was downloaded.

Updated the red flag, flag complete, and clear flag icon.

In previous builds, when adding a new group to a complex filter and no criteria was selected, the group was added below the first criteria. The group is now added to the end of the list.

Added Ctrl-C handler to system status items enabling the user to use text to speech software on this page.

The Ctrl-C event handler was not being properly handled when focused on an entry. This bug has been fixed.

Summary: Fixed several Configuration Wizard bugs

In previous builds the tab order was accidentally changed. This bug has been fixed.

In previous builds if you assigned a filter without assigning an action, a cast exception was thrown. This bug has been fixed.

From the Configuration Wizard, when an assigned filter or action was assigned to a sub-set of selected configurations the highlight color and highlight text colors were difficult to read on certain themes. This bug has been fixed.

From the Configuration Wizard, when removing the last action from an assigned filter, the filter was removed in the configuration but not form the user interface. The behavior has been changed to leave the filter assignment in the configuration.

From the Configuration Wizard, when double-clicking an item in the assigned filters or assigned actions list box a fatal error was thrown. This bug has been fixed.

In previous builds the installation was not updating the toolbar settings file. Several newly added toolbar items were not displaying. This bug has been fixed.

Summary: Added MDI support and automatic log discovery and selection.

Added MDI support. Each log or merge is now displayed in its own tabbed window enabling users to flip between different logs.

An automatic log discovery function was added enabling systems administrators to search a domain for a specific computer name or computer type, discover the available logs, and lastly select the specific logs. This function is available for both the Network view and the Active Directory view. Users can also use this function to select specific logs via the Downloaded Logs view. To use this function, select the domain or logical group and select Select Specific Computers from the Tools menu item.

The message preview has been modified to remove line feeds and white space enabling more of each message to display.

Summary: Welcome to Network Event Viewer 2007

Network Event Viewer now includes a Syslog server that saves received messages enabling users to consolidate syslog messages, assign filters, and fire actions.

Logs can now be consolidated to a MySQL 5.0 database.

The viewer now optionally displays a preview of each message.

The Downloaded Logs view now lists all logs under their corresponding logical group.

When a domain is enumerated via the Network View or the Configuration Wizard, the each computer type is determined enabling the software to display different icons for domain controllers, computers running SQL Server, servers, and workstations. Users can automatically select any of the 4 types by right clicking the Network View and selecting Select Specific Computers.

We have added simple filters back into the application. Users can now create simple and complex filters.

Users can now associated comments with each entry.

Actions have been totally overhauled. Users now configure global actions and assign them to download configurations enabling simpler action management and assignment. Network Event Viewer now supports firing sound and message box notifications. The system tray popup has been overhauled as well enabling the oldest entry that passed filter criteria to appear in the balloon popup.

Users can now export event logs to the Windows EVT format enabling consolidated logs to be viewed in Windows Event Viewer.

In 6.0 filter action events were stored in a file. In 7.0 if using a database backend to store consolidated logs, the filter action events are now stored in the database. This format enables multiple installations of Network Event Viewer to view the filter action events.

Users can now rename logical groups by pressing F2 from the Configured Computers view.

Added the ability to flag filter action events.

The Configuration Wizard now verifies download rights against the Application log which should decrease the amount of security errors users receive.

Added logical group tree node expanders to the Configured Computers view enabling users to easily expand and collapse logical groups.

Added an On Enter handler to the Find window enabling users to type a message to search for and press enter without having to use their mouse to click on the Find button.

Updated the View Service Log toolbar icon.

When downloading logs from Vista computers or remote computers with different time zones set, the time was stored incorrectly. This bug has been fixed.

If storing event logs in SQL Server and a message was over 4096 bytes, a truncate error was thrown stopping all older entries from being saved. The message is now truncated and all older entries saved.

In later builds of 6.0 a bug had been introduced that disabled navigation through the viewer from the entry popup window. This bug has been fixed.

The Active Directory Auto Configuration dialog used to open when there were no current configurations and no active directory node was selected. This bug has been fixed.

The Find window did not trap the On Delete event enabling the user to delete characters from the message search text box. This bug has been fixed.

Tab order for some items in the Filter dialog was incorrect. This bug has been fixed.

Summary: Fixed SQL Server null message bug

Logs that contained events with null messages would not display when a filter that contained message criteria was applied. This bug has been fixed.

Summary: Fixed regular expression filter criteria bug

Regular expression evaluation for event type filter criteria did not work. This bug has been fixed.

Does Not Contain exclusion filter criteria did not work. This bug has been fixed.

When deleting a filter, the mouse cursor would switch to an hour glass without returning to a pointer until the dialog was closed. This bug has been fixed.

Summary: Users can now specify credentials is access is denied from the Network view

When selecting a log file via the Network view, if access is denied no message box was displayed. A message box is now displayed and the user is given the opportunity to specify credentials.

When opening the Options dialog before any logs have been downloaded, users would be asked to create the output directory. The output directory is now automatically created.

When browsing for the html template via the options dialog, the folder was not automatically selected. This bug has been fixed.

In the download status window, the word ‘entries’ was misspelled in 2 different places.

When configuring a new computer, the Enabled check box was un-checked. The check box is now checked.

When viewing the properties for certain event log files, such as Internet Explorer, an object reference error was thrown. This bug has been fixed.

Summary: Added support for application data folders

All application data files are now stored in the common and application data paths.

When converting legacy filters and creating new filters, the match case and use regular expressions flags were not saved. This bug has been fixed.

The Filter Action Events view now supports multi-select enabling users to delete multiple filtered events from the view.

When applying a filter, in previous builds, the type filters that were current set were still executed. In other words, if the filter stated to show all, for example, warning events, but the warning event type toolbar button was de-selected, no warning events would be shown. The application now sets all event type filters and then executes the filter. Once the filter has executed, the user can then use the event type toolbar buttons to filter out specific event types.

The toolbars were updated to isolate filter toolbar buttons.

When merging logs, the host names and log names that are contained in the merge are now displayed in the detail view. The header can now be resized so all merge information can be viewed.

Summary: Overhauled filtering algorithm

Filtering has been totally overhauled. You can now create nested search criteria that includes support for AND, OR, and NOT criteria.

When deleting a filter, reports were not scanned for dependency. This caused reporting to fail with an object reference not found error. This bug has been fixed.

Added De-Select All menu item to the Network view’s right click popup menu.

The installation now closes all open Network Event Viewer windows.

Summary: Added E-Mail and HTML output customization support.

Email content and HTML output can now be customized using file templates.

Added tag insertion support to the Configuration Wizard, the Reports Wizard, and the Option’s dialog Mail Contents tab.

When the application starts up the first time, the user is no prompted to configure the email server connection.

When creating or modifying a report, the check box to run the report upon dismissing the dialog is now checked by default.

The Option’s dialog description of the maximum number of days to download was updated.

The content of the Report Wizard’s Verify tab was updated.

The help file was updated.

Summary: Remove NetWare Services from the Network view

In previous builds, networks that have Novell servers would list the servers in the network view. Since Novell servers do not have Windows Event Logs, this node no longer appears in the Network view.

A minor bug that generated a ‘File not found’ error in the service log has been fixed. Several status messages were added to the Report algorithm.

Several changes were made to increase the load time of the internal service log when viewed from the user interface. The entries are also now sorted from oldest to newest.

Summary: Fixed Configuration Wizard bug

Since logical grouping was added, the new Configuration Wizard would always throw a cast exception when dismissed. This bug has been fixed.

Since logical grouping was added, a refresh of the Configured Computers view would cause all items under the Unassigned Logical Group to reload. This caused any checked items to lose their check state. This bug has been fixed.

Summary: Fixed tray icon bug

Since build 6.0.0.46, the tray icon was not updating properly. This bug has been fixed.

Summary: Added digital signatures

The installation executable and all Corner Bowl Software developed binaries are now digitally signed.

On Windows Vista, the tray icon did not startup the application with administrator rights. A manifest file was added to fix this bug.

Summary: Fixed Install Issue on Vista

On Windows Vista, the installation would install the shortcuts with Standard rights even though the program requires administrator privileges. This bug has been fixed.

Summary: Fixed email bug on Vista

When running on Windows Vista, the software would send the IP address instead of the domain in the HELO or EHLO commands. Since Vista defaults to IPv6, the command would fail. The behavior has been changed to send the domain as required by the RFC 821 rather of the IP address.

Previously there was no way to download a portion of a log file that contained hundreds of thousands of entries per day during the first download. To accomplish this, users must change the default WMI download option from ‘Minimize remote CPU…’ to ‘Minimize local memory…’ via the Options dialog. Once selected, any attempted first downloads which are cancelled, are now saved.

Summary: Added SQL Server Windows Authentication mode support.

In previous builds, Network Event Viewer only supported SQL Server authentication. The application now supports both SQL Server and Windows Authentication modes. Use the Options dialog to set the login preference. Please note, the Network Event Viewer service must be running with appropriate Windows credentials to properly connect.

Moved all registry keys from Janco Associates, Inc. to CornerBowl.

Summary: Added several help messages and fixed several bugs

A help message is thrown when the user attempts to deselect all message types or logs from the toolbar.

In demo mode the Configuration Wizard was allowing users to configure more than 4 computers. Once configured, users could not open the Configuration Wizard with all the configured computers selected. This bug has been fixed.

When scheduling a report, the Verify configuration tab displayed the schedule incorrectly. This bug has been fixed.

Summary: Add Logical Group support

Users can now place configured computers into logical groups. To create a new logical group, select New Logical Group from the File menu item. Specify a name. Use the mouse to drag and drop each configured computer to the appropriate logical group.

Summary: Added auto configuration

Network Event Viewer can now watch Active Directory tree nodes for new computers. When a new computer is discovered, pre-configured settings are applied and logs automatically monitored and archived. Configuration settings are saved via the standard Configuration Wizard dialog. The Configuration Wizard dialog also now supports loading already saved configuration templates.

All the combo boxes that list Event Logs now include the default Windows Server logs: Directory Service, DNS Server, File Replication Service.

Summary: Registration and auto-update now support proxy servers.

In previous builds users on networks that utilize HTTP proxy servers were unable to register the software and receive automatic product updates. Once the proxy server is set via the registration dialog, users now receive automatic updates.

Summary: Fixed toolbar bug

When a filter was created from the Configuration Wizard dialog, the toolbar filter combo box was not updated. This bug has been fixed.

Summary: Fixed several report and file output bugs

When overriding the default output filename in the Configuration Wizard, the file browse dialog did not include support for html or txt files. This bug has been fixed.

The Report Configuration wizard did not include support for output to html or txt files. This bug has been fixed.

When exporting Report results to csv or xml, an object reference error was thrown and the report would not be generated. This bug has been fixed.

Summary: Added auto refresh support

The viewer now, optionally, automatically refreshes the log view. To enable auto refresh and set the refresh frequency, open the Options dialog from the Tools menu item. Select the Display tab. Specify the refresh options.

Summary: Added several filter periods

Users can now create filters for all events that have occurred today, yesterday, the current week, or the previous week.

Summary: Added Data Mining Reports

Network Event Viewer now supports on-demand and scheduled reporting of downloaded logs. This functionality has been long awaited and now offers systems administrators the ability to receive weekly reports of specific events. Please note, events are sorted by date in ascending order.

Summary: Added download error email support

You can now email download error alerts. To configure the service to email an alert when a download fails, select Options from the Tools menu. At the bottom of the download tab, enable the error email alert, specify the address, and lastly specify the subject. The subject supports the following replacement tags: , , .

If the user moved the navigation bar commands up or down, the new position were lost when the application was re-loaded. This bug has been fixed.

Summary: Added Active Directory Support

Users can now configure computers grouped within Active Directory nodes. The default Active Directory tree is discovered, however; other Active Directory trees can be configured via the Options dialog. Manual configuration may be required if running via a VPN connection.

The HTML output was updated to better support printing.

Summary: Enhanced multi-threaded download algorithm

A large download would previously block downloads scheduled after the large download started. The download algorithm has been enhanced so other downloads can start while a large download is currently running.

Modified the format of the output messages so they are easier to read.

Summary: Fixed Italian localization bug

When using SQL Server to store logs on an Italian system, an error was thrown preventing the logs from being stored. This bug has been fixed.

Summary: Fixed temp file leak and I18N table truncation bug

When downloading, NEV would leak temporary files. This bug has been fixed.

On computers running UK locale systems, NEV was unable to truncate SQL Server tables. This bug has been fixed.

Summary: Updated regular expression search criteria.

Both the search criteria and find dialog now optionally support regular expressions for Source, Category, Event ID, and User.

Updated the view detail header color for the Royal theme.

Summary: Added automatic popup of map computer dialog when access to available log list is denied.

The map computer dialog automatically displays when selecting a computer on the Logs tab of the Configuration Wizard or when selecting a computer from the Network View and the user's credentials do not have rights to query the list of available logs.

The 'Limit filter actions to new entries' option has been removed. This option made little sense and was likely confusing to many. We removed this option to simplify the download tab of the options dialog. The option enabled users to apply a new filter to all previously downloaded entries and execute filter actions for the entire log file (not including archived or backed up entry files). If a new filter is created and a filter action needs to be applied to entries already downloaded, delete the downloaded log file and wait for the next scheduled download. If other filter actions have been assigned and entries already passed those filters, the assigned filter action will execute again. If you use this option, please contact us to talk about your situation so we can determine if we should roll the option back in.

When downloading a log and either the maximum number of days to store (SQL Server) or the maximum file size (file system) is reached, the message output was 'informational'. The level has been increased to 'notice' and the message string updated.

If a computer was mapped with lower case and logs were retrieved from the Network View (and the casing in the network view was upper), 2 computers would display in the downloaded logs view. Entries downloaded from the Network View would display the host name in the casing as seen in the Network View while logs downloaded via the Configured View or Downloaded logs view would display in the casing used when the computer was mapped. Computer nodes now always display in upper case in the Downloaded Logs view. All entries now display the hostname in upper case as well.

On some systems the output windows would display the icons with a black background. This bug has been fixed.

The icons in the detail list view were washed out. This bug has been fixed.

Summary: Updated help file and fixed several minor bugs

Made numerous help file updates per recent GUI and engine changes.

When mapping a computer, the computer is now automatically selected.

Added select all and de-select all to Download Logs and Filter Action Events views.

Updated several menu bar/toolbar item states.

Update the tip of the day content.

Summary: Added Getting Started Guide to Help

Added Getting Started section to help which includes sample tasks.

Added SQL Server connection and command timeout configuration parameters to the Option dialog.

The toolbar buttons were not updated when moving focus to the Configured Computers view. This bug has been fixed.

Summary: Updated Filter Dialogs

Removed the filter combo box from the Filter menu item. Renamed Manage Filters menu item to Filters. Updated the content and the visual appearance of the View Filters dialog and renamed the View Filters dialog to Filters. Renamed the Add Event Filter dialog to Filter Criteria.

Removed the message ‘You must check at least one computer’ in all cases except when selecting the Merge command and no computers or logs are selected.

Updated several menu bar and toolbar command states.

Summary: Added Filter Action Events view and smart tree view refresh.

When using the file system to store logs, the backup option used to re-download the entire log. The functionality has been changed to only download the entries since the previous download. All previous entries are backed up, and the new entries appear in the root log. To view all the entries at once, simple select the logs in the date folders to merge.

The notifications or filter action events, used to display in a popup Window. The Window was removed in build 6.0.0.12 and replaced with a tree node in the Downloaded Logs view. The tree node no longer exists in the Downloaded Logs view. Instead a Navigation view called Filter Action Events was added. Each filter action that has had entries pass is displayed. To remove all entries for a specific filter action, select the filter action and click the Delete toolbar icon.

Added 3 view icons to the Data view. You no longer have to right-click to view the data in Ascii or Unicode format. The view format was not saved in previous builds, this bug has been fixed.

All of the Navigation views now support smart refreshing. Instead of reloading each view when a change is made, the tree is iterated, new items added, old items removed.

From the Configured Computers view, all computers with at least one log configured for automatic download display a clock in the icon.

Network view icons were washed out. This bug has been fixed.

Added label to the left of the new page size control in the detail view.

Several toolbar icons were updated.

The Save Log As dialog now reloads the last directory a log was exported to.

The page buttons sometimes included an extra day. This bug has been fixed.

Summary: Removed Download Dialog and added Download Status view

When downloading, the Download Dialog no longer appears. Instead, the status is logged to a new view called Download Status. A cancel download button was added to the toolbar. Users can now minimize the application while it is downloading.

Added a page size control to the detail header.

Summary: Added CPU or memory utilization options

Added a major update to the download log algorithm. Users can optionally specify, via the options dialog, to use local memory or the remote CPU to handle each log query.

The icons in the Navigation bar and the log view were washed out. This bug has been fixed.

Summary: Fixed several bugs including a SQL Server display bug

When using SQL Server to store logs, entries written after 12:00 PM on the current day were not showing up. This bug has been fixed.

The Follow Up option was enabled when viewing the Notification Log entries. The notification log does not currently support this feature so the menu item is now appropriately disabled.

Made minor control position adjustment to the Log Properties dialog.

Summary: Fixed several credential and internationalization bugs

The Change Service Login dialog did not support an account with a blank password. This bug has been fixed.

When service credentials are assigned via the Change Service Login dialog, 'Log on as Service' rights are now assigned to the specified account.

The log view now limits the message level column width.

When using SQL Server to store all logs and the locale was set to English (United Kingdom), the logs would not display. This bug has been fixed.

When selecting a log from the Downloaded Logs view, the properties menu item did not enable. This prevented the user from seeing the Log Properties dialog. This bug has been fixed.

The output window now contains icon representation of the message level and the time the message was added to the window. The control now displays tooltips on mouse over.

Summary: Integrated notification form into main form. Added numerous other enhancements and bug fixes.

The notification log window has been removed and replaced with a tree node in the Downloaded Logs view. Upon selection, the notification entries display. When displayed, a filter column header is present. The notification log is now cleared by clicking the Delete toolbar button. To remove a single entry from the notification log, select the item and press Del or click the Delete toolbar button.

Added display information to list view header.

From the Network View, you can now select the Mapped Computers tree node, right click, and click ‘Select Specific Computers’. The following dialog enables users to search and check mapped computer tree nodes using regular expressions.

The configuration wizard now contains a download now check box. The check box is automatically selected when configuring logs for the first time. Once configured, the check box is no longer automatically selected.

When left clicking in the flag column, the flag state is now automatically iterated from none to follow up, to flag complete, to the clear flag.

The event type and flag columns are now fixed width.

The download toolbar button icon was updated.

The tray icon message and icons were updated.

The Change Service Logon menu item was changed to Change Service Login.

Upon mapping a computer, the Mapped Computers tree node is now automatically expanded.

Added some debug messages when truncating SQL Server table. To view the messages, run the service in verbose mode.

The export to CSV was writing out null when using the file system cache and the record id when using the database cache. This bug has been fixed.

Date time format was always in MM/dd/yyyy format instead of using the system locale format. Entry date time information is now displayed in system locale.

The follow up flag only worked when using the SQL Server log cache. While fixing this bug, the follow up icons were updated.

When upgrading, the installation uninstalled the service and re-installed it. When re-installed, the previous credentials were dropped. The upgrade installation no longer uninstalls the service but rather stops the service, updates the file, and lastly re-starts the service maintaining the service credentials.

On startup, if the user did not have administrator rights, the application crashed. This bug has been fixed. The application now, notifies the user and then exits.

Machines that had multiple IP addresses might have seen an error at startup stating the license was assigned to another computer. This bug has been fixed.

Summary: Fixed several critical bugs with the schedule controls in the Configuration Wizard

Fixed several critical bugs with the schedule controls in the Configuration Wizard

Summary: Added new help file

Added a new help file and updated links throughout application.

When creating the Configuration Wizard in 6.0, the maximum log files size parameter was dropped from the user interface. This bug has been fixed.

The mapped computer properties was displaying the logged in users domain even if the credentials set did not use a domain. This bug has been fixed.

Summary: Fixed major upgrade bug

The Actions tab of th