topic Re: Windows eventlog can not be collected by Universal Forwarder in Getting Data In

Windows eventlog can not be collected by Universal Forwarder

jichen — Tue, 30 Apr 2013 16:29:54 GMT

I have some windows machine to collect their eventlog, most of them works fine, but several of them can not send data to indexer server.
They're win2008R2 with same forwarder agent and configuration, the inputs.conf set as below
[WinEventLog:Application]
index=main
[WinEventLog:Security]
index=main
[WinEventLog:System]
index=main

I'm sure the network is fine,and the server also received the agent itself log in _internal database,but no windows log at all. I see the forwarder's log ,it record like something 'wmi.exe read 0.434 second, 0 byte read', but I'm sure there're plenty of events in the windows system. I clear the windows event log and restart the forwarder agent, the problem remains.
How to solve this issue, I think it's due to the windows OS itself,maybe the .DLL problem? Someone met the same problem?

Re: Windows eventlog can not be collected by Universal Forwarder

Ayn — Tue, 30 Apr 2013 19:08:40 GMT

Not an answer per se, but some troubleshooting tips:
1. Use amrit's script to check what status Splunk has for each input. http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/
2. Check splunkd.log on the forwarder for hints on what could be wrong.

Re: Windows eventlog can not be collected by Universal Forwarder

jichen — Fri, 03 May 2013 16:32:04 GMT

Hi, I haven't done the troubleshooting yet, but I reinstall the agent and select the monitor option(security,system,application),then it's ok,but when I manually config the inputs.conf, no stuff indexed again.

Re: Windows eventlog can not be collected by Universal Forwarder

Keysofsandiego — Mon, 23 Mar 2015 18:32:01 GMT

Im still a newb myself but try adding the disabled switch to your inputs.conf.

[WinEventLog://Security]
disabled = 0
index = windows

[WinEventLog://Application]
disabled = 0
index = windows

[WinEventLog://System]
disabled = 0
index = windows

Also, you might want to make sure the outputs.conf is also configured too... example below.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = YOURSPLUNKSERVER:PORT

[tcpout-server://YOURSPLUNKSERVER:PORT]

Hope this helps.
Happy Splunking!
=)