Link to home
Start Free TrialLog in
Avatar of Harrris
HarrrisFlag for Cyprus

asked on

Collecting Windows Event Logs from multiple PCs


Is there a way to automatically receive/save windows event logs from all user PCs in text files, on a specific server (e.g. on the Domain Controller).

Also, I noticed that in Windows Server, Under Event viewer there is no option for event Subscriptions, like on normal Operating Systems. Is there a different way to configure event subscription on Windows server?
Avatar of ActiveDirectoryman
ActiveDirectoryman


   Windows server 2008 supports event forwarding. This will allow you to forward events from different machines to a single  server or client.    

Configure computers to collect and forward events
http://technet.microsoft.com/en-us/library/cc748890.aspx
if you look under windows logs you should see a forwarded events log.  this is where you logs will go.
Avatar of Harrris

ASKER

In windows server 2003, there is no "forwarded events" item under event viewer. Is this different for Windows 2003 and 2008?


You have to have at least windows server 2003 R2  use the event collector service.   If you want to use a 2003 server to forward the events to that server has to be 2003 R2. you cannot use a non-R2 2003  server as a event collector. You can use a 2003 non-R2 server as a source but not as an event collector.  

check out this article:

http://msdn.microsoft.com/en-us/library/windows/desktop/bb427443(v=vs.85).aspx
Avatar of Harrris

ASKER


I have a Windows 2003 R2 Installation, but I cannot see a "forwarded events" or "subscriptions" item, under the event log. Do I have to start a specific service, or to install anything, in order for this to appear under event log?
ASKER CERTIFIED SOLUTION
Avatar of ActiveDirectoryman
ActiveDirectoryman

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Tolomir
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.