Link to home
Start Free TrialLog in
Avatar of jsctechy
jsctechyFlag for United States of America

asked on

how can i ship my windows logs (event viewer) off to a syslog-ng server

looking to get all my windows server logs (event viewer logs) shipped off to a syslog-ng server
how can i do this? do i need some sort of windows agent installed on the windows boxes to ship them off to the syslog-ng server?

Avatar of motnahp00
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
If so here's an example of what you need to do in terms of configuration.

winrm qc
net localgroup "Event Log Readers" DCNugget1$ /add

wecutil qc
winrm qc

Subscription name: Criticals and Warnings from Nugget2
Destination log: Forwarded Events
Collector initiated
Select Computers -> Nugget2
Select Events -> Critical, Error, Warning
Events Logs -> Applications
User Account: Machine Account
Avatar of jsctechy


thanks motnahp00
what about for older versions of windows? they dont have this capability correct? (windows 2003)
Windows Server 2003 does not have this capability.
do you know of any agents that i can install to ship this to a syslog-ng server?
You can see if there is any integration with Puppet.