How to forward window logs to loganalyzer

Event Log Forwarder for Windows

Log Forwarder for Windows

The purpose of this free program from SolarWinds is to send events, which have been captured by a Windows server, to a Syslog server for processing.

The problem this nifty utility solves is that Windows servers don't natively support syslog protocols.  Thus the dashboard supplied gives you a method for consolidating event log messages, and works well with SolarWinds Kiwi and Orion products.

Installing SolarWinds Event Log Forwarder for Windows

I test numerous software packages, and I often criticise programs for their complex install routines, but in the case of the Log Forwarder for Windows, Guy says:- "This setup couldn't be easier."

Simply download and then install the program from its .msi file.  As a result you will get an interface (LogForwarderClient.exe) where you configure log Subscriptions and connect to your Syslog server.  Meanwhile, the underlying SolarWinds program (LogForwarder.exe) has installed as a Windows Service called: Log Forwarder for Windows.

Creating Subscriptions at Your Log Forwarder Dashboard

As you may expect, Event Log Forwarder for Windows supports the latest Windows eventing 6 ("Crimson") format, in addition, there is backward compatibility with the old Windows Eventing 5 from the Window Server 2003 and XP era.

XML experts may be interested in studying LogForwarderSettings.cfg file; they may wish to amend tags in the < EventLogSubscriptions> and <SyslogServers> sections.

Adding Individual Log Subscriptions

At the heart of the Event Log Forwarder is the interface which links to the actual Windows Logs.  Click on 'Event Sources' [key point] and select which subscriptions you wish to collect in the logs that will be sent to the Syslog server. 

After a few trials, you will appreciate the flexibility of this utility; at which point you may like to go back and adjust your subscriptions.  Alternatively, after a bout of testing I often delete and start again.

Connecting a Syslog Server to Your Dashboard

Please remember that in order to get any action with the SolarWinds Event Log Forward for Windows, you need a Syslog server.  It's vital to have a server which can receive logs such as security, application or system, which are forwarded by your Windows machine(s).

The source of these event logs can be Windows Server 2003 R2 or later; alternatively, you could trial the forwarder from a client such as Windows 7 or 8.

Note that SolarWinds' latest version supports sending event messages using TCP, (rather than UDP).

Test Screen

The 'Test' tab actually allows you to create an entry in one of the Event Logs on your Windows computer.  The screen enables you to test that forwarding to the Syslog server specified is indeed taking place.  Naturally, you can only perform a test on event that you have already added in your 'Subscriptions'.  Here is a screenshot of the Test Screen tab.

The result you are looking for is: "test event created successfully". However, if there's any error, then you get a message saying: "creation of test event was unsuccessful".