UAG Web Monitor shows “There are no events to display”

  • Article

Symtoms:

When starting Web Monitor and selecting any option under the Event Viewer category, the Web Monitor displays the following message:

"There are no events to display"

Additionally, if you have a UAG Array and you select "Current Status" under the Array Monitor category, you may see that the UAG nodes show a Synchronization Status of "error".

While troubleshooting the issue, the UAG tracing output may show an entry similar to the following:

[0]21FC.2F28::<Date/Time> [MonitorHelper]The dummy request failed: System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it <UAG server internal IP address>:50002

Note: For more information on UAG tracing, please see my teammate Ben Ari’s blog on UAG Tracing:

https://blogs.technet.com/b/ben/archive/2010/09/03/uag-tracing-made-simple.aspx

More information:

By default, UAG servers are configured to log UAG related events to the following location:

<UAG install folder>\logs\Events

You can then use Web Monitor to view and filter those logged events. See the following TechNet article for more information related to UAG logging:

https://technet.microsoft.com/en-us/library/ee428828.aspx

By default, both the LOGS folder and EVENTS folder have the following Security Permissions:

SYSTEM - Full Control

NETWORK SERVICE - Full Control

Administrators (<localserver>\Administrators) - Full Control

Users (<localserver>\Users) - Read & execute, List folder contents and Read

Cause:

You may see the above Web Monitor errors if the NETWORK SERVICE does not have the proper permissions for the Logs and/or Events folders.

Resolution:

Make sure that the NETWORK SERVICE has Full Control permissions for the Logs and/or Events folders (including subfolders and files).

Author

Richard Barker - Sr Security Support Escalation Engineer, Microsoft CSS Forefront Security Edge Team