https://community.splunk.com/t5/Getting-Data-In/Forwarders-on-Win-2008-SP1-stop-forwarding-events/m-p/61778#M12336 <P>We're noticing that all of our Windows 2008 SP1 machines stop forwarding events from the security event log over the weekend. This appears to coincide with our EventArchiver process rotating/clearing the logs locally on the systems. This problem does not occur with XP, 2008 R2, or Windows 7 environments. Searching around I found something that appears to be similar at: </P> <P><A href="http://splunk-base.splunk.com/answers/3456/windows-event-logs-stop-forwarding-why">http://splunk-base.splunk.com/answers/3456/windows-event-logs-stop-forwarding-why</A> </P> <P>but it was from over a year ago. Does anyone know if that particular thread still applies to current (4.2.2) forwarders? Events do not get sent on until the universal forwarder service gets stopped/started manually.</P> Mon, 22 Aug 2011 12:42:20 GMT chadroberts 2011-08-22T12:42:20Z https://community.splunk.com/t5/Getting-Data-In/Forwarders-on-Win-2008-SP1-stop-forwarding-events/m-p/61778#M12336 <P>We're noticing that all of our Windows 2008 SP1 machines stop forwarding events from the security event log over the weekend. This appears to coincide with our EventArchiver process rotating/clearing the logs locally on the systems. This problem does not occur with XP, 2008 R2, or Windows 7 environments. Searching around I found something that appears to be similar at: </P> <P><A href="http://splunk-base.splunk.com/answers/3456/windows-event-logs-stop-forwarding-why">http://splunk-base.splunk.com/answers/3456/windows-event-logs-stop-forwarding-why</A> </P> <P>but it was from over a year ago. Does anyone know if that particular thread still applies to current (4.2.2) forwarders? Events do not get sent on until the universal forwarder service gets stopped/started manually.</P> Mon, 22 Aug 2011 12:42:20 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarders-on-Win-2008-SP1-stop-forwarding-events/m-p/61778#M12336 chadroberts 2011-08-22T12:42:20Z https://community.splunk.com/t5/Getting-Data-In/Forwarders-on-Win-2008-SP1-stop-forwarding-events/m-p/61779#M12337 <P>I've had the similar problem there <A href="http://splunk-base.splunk.com/answers/27441/forwarder-doesnt-collect-or-pull-data-after-some-time">http://splunk-base.splunk.com/answers/27441/forwarder-doesnt-collect-or-pull-data-after-some-time</A></P> Thu, 25 Aug 2011 10:57:00 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarders-on-Win-2008-SP1-stop-forwarding-events/m-p/61779#M12337 Vladimir 2011-08-25T10:57:00Z