topic Re: Why are Windows events logs no longer being forwarded after universal-forwarder upgrade to 6.1.2 for Windows 2008 R2? in Getting Data In

Why are Windows events logs no longer being forwarded after universal-forwarder upgrade to 6.1.2 for Windows 2008 R2?

ebailey — Mon, 28 Sep 2020 18:34:29 GMT

We just upgraded a very old UF on Windows 2008 R2 to 6.1.2 None of the Windows event logs are being forwarded to the indexer though the UF logs and and custom application logs are being forwarded to the indexer so I know the UF can forward data.

The inputs.conf for the Windows Event logs

[default]

[WinEventLog:Application]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = test

[WinEventLog:Security]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
blacklist = 5156|4656|33205|5158
index = test

[WinEventLog:System]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = test

We have a lot of other UF installs that are using this inputs.conf so I am confused why this it not working.

The only related message I am seeing is:

INFO ModularInputs - No stanzas found for scheme "WinEventLog" in inputs.conf at script (re)start.

Any ideas why the inputs.conf is being ignored?

Thanks

Re: Why are Windows events logs no longer being forwarded after universal-forwarder upgrade to 6.1.2 for Windows 2008 R2?

ebailey — Mon, 28 Sep 2020 18:36:18 GMT

figured it out - forgot //

[default]

[WinEventLog://Application]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = tu_windows

[WinEventLog://Security]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
blacklist = 5156|4656|33205|5158
index = tu_windows

[WinEventLog://System]
checkpointInterval = 5
current_only = 1
disabled = 0
start_from = oldest
index = tu_windows

Re: Why are Windows events logs no longer being forwarded after universal-forwarder upgrade to 6.1.2 for Windows 2008 R2

jacbob — Thu, 28 Apr 2022 18:27:34 GMT

I had a similar issue however the solution was different because I had the correct syntax (I had the forward slashes).

I took the Windows TA and decided that for the WinNetMon stanza I only wanted it to go to specific windows servers as opposed to all of them in my environment. And instead of deleting the stanzas from the Splunk_TA_Windows/local/inputs.conf , I set disabled = 1. So when I created another app specific for the WinNetMon stanza and set that disabled = 0. The disabled = 1 took precedence over my custom app, hence Splunk could not find a WinNetMon stanza.

Deleting the WinNetMon stanzas from Splunk_TA_Windows/local/inputs.conf fixed my issue.