topic Re: Universal Forwarder only sends monitored log file once per restart... in Getting Data In

Universal Forwarder only sends monitored log file once per restart...

nabeel652 — Tue, 26 May 2015 11:27:14 GMT

I have a universal forwarder installed on my Print Server (Windows 2012 R2). I used WinPrintMon but it is giving some funny results. However, I am able to pull out printer logs through pointing directly to the file c:\windows\system32\winevt\logs\microsoft-windows-printer%4operational. However, the forwarder only sends once the logs when restarted. After that it will not send any logs until restarted.

Re: Universal Forwarder only sends monitored log file once per restart...

richgalloway — Tue, 26 May 2015 11:52:12 GMT

What are your inputs.conf settings?

Re: Universal Forwarder only sends monitored log file once per restart...

nabeel652 — Tue, 26 May 2015 12:09:19 GMT

[monitor://c:\windows\system32\winevt\logs\Microsoft-Windows-PrintService%4Admin]
disabled=false
index=printmon

I've also tried with MonitorNoHandle but in that case the forwarder doesn't send data at all.

Re: Universal Forwarder only sends monitored log file once per restart...

acharlieh — Tue, 26 May 2015 12:18:52 GMT

Why are you using a monitor stanza instead of a WinEventLog stanza similar to: http://answers.splunk.com/answers/124859/unable-to-index-microsoft-windows-printservice-operational.html

Re: Universal Forwarder only sends monitored log file once per restart...

nabeel652 — Tue, 26 May 2015 12:38:10 GMT

Thanks buddy, adding WinEventLog stanza solved my problem Cheers 🙂