Restituisci
-
Titolo
Incorrect origin information for events -
Descrizione
Change Auditor is returning the incorrect origin for events -
Causa
This is most likely a DNS issue in the environment at the time the event took place. Change Auditor uses the IP of the machine and DNS lookup for the host name. -
Risoluzione
Confirm if the IP Address for Origin of the events is being recorded by adding the "Origin IPv4" column to the Search results.
Using the Origin IPv4 address, perform an NSLookup from the server that the event with the blank Origin was recorded (Where field):
NSLookup <Origin_IPv4>
Confirm if the correct machine name is returned.