Hash: SHA1

I do not know specifically which event would do this, but here are some
steps to narrow down why it is happening:

First, anytime you have an odd collector parsing issue get a connector dump.
1. In ESM go to the relevant connector node.
2. Go to the node's settings (right-click, then 'Edit' or something)
3. Enter a path for a dump file and check the box to enable it.
4. Duplicate the event(s) in question.
5. Go back to the connector node and disable the connector dump (checkbox).
6. Look at the resulting file to see your events.

At this point you can see if, besides the event viewer, the windows
machine actually sent (or had pulled usually) the event in the same way
as you expected. If not then you need to fix the event source (windows
in your case) and if so then we can start debugging the collector. You
can do this either by opening a Service Request (SR) with Novell/NetIQ
and sending the connector dump describing exactly what you are seeing
(screenshots, event exports, good descriptions, etc.), or you debug on
your own.

Debugging on your own:
1. Create a new collector node for your type of collector.
2. Create a File Connector underneath your new collector.
3. Create a file event source under the connector which points to your
connector dump file. Offset: Always start from beginning. 'Replay' or
'Connector Dump' mode (or something like that) should be chosen for the
file format.
4. Start the collector in debug mode and step through until you see
what is happening.
*Note* - There is a lot to step 4. I'd recommend opening a ticket with
Novell/NetIQ unless you are a fairly comfortable programmer.

Good luck.
Version: GnuPG v2.0.18 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

ZU84XGTsh5SxPmviaMuxQcVUkRECbVS8kOI52uKGeqfX4Cl2Sq BNBViIBvldUnxf
jfQOZurvGFs07QtVeOaFTf9tFCcUBg22Z5IHOdRVs4zhLJ3uqA WqNOuDl8H3yccw
8aIZ1Rph/9Bachr5E4numRQ0W6oDr8NSJwxFU5bcbzHfU5fGzauEnO77sDo hRYK5
31hHPQd5Ib+cTj+zTZlvTiSkFcMWrfIHxkjsKOc60EqCCQ+2je LY7mYj3ZRxA8+n
TNsoGi5Vhq96JazbTgZj7iqxmFqUCbYH0hLvsQRYNIDzZfTLzm fAMBVKgF2VMksQ
pmbcxqhpcERKKm0iueK5unQ1wDhstyZ3HFJSrp8KQHW80uWt7g Z1Je2rfpg0cgVy