Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Centralizing Windows Logs

Posted on 2016-07-28
2
Medium Priority
?
104 Views
Last Modified: 2016-08-17
Hello,

I am running Windows 2008 R2 Servers that I need to keep track of the Window event logs and the Windows System logs. Is there a way to setup an automated process that allows me to centralize my logging to one location?
0
Comment
Question by:ahmad1467
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 42

Expert Comment

by:Adam Brown
ID: 41733463
The 2008 R2 event viewer allows you to collect logs from remote servers automatically to a single server using Event Log Subscriptions. https://technet.microsoft.com/en-us/library/cc748890(v=ws.11).aspx has info.
0
 
LVL 18

Accepted Solution

by:
Emmanuel Adebayo earned 2000 total points
ID: 41733465
Hi,

Yes, you can configure Windows Event Subscription by which Windows server forward its events to a “subscribing” server call a collector to become a central repository for Windows logs from other servers in the network.

Setting up and Configure Centralized Logging Computer (Collector)
On the server that will be Collector (That will collect events from other servers)
Run the following commands
  • winrm qc
You can use the –q switch, to perform the actions automatically and silently

wecutil qc /q (This will configure the evet collector service)

Setting up and Configure Computer to forward to the Centralized Log Computer (Subscribing)
Run the following commands
  • winrm qc –q

For more information, please visit
http://www.windowsecurity.com/articles-tutorials/authentication_and_encryption/Centralized-Auditing-here-FREE.html

https://www.loggly.com/ultimate-guide/centralizing-windows-logs/
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question