topic Problems with WinEvent collection on Windows2000 Server in Getting Data In

Problems with WinEvent collection on Windows2000 Server

jbrocks — Mon, 13 May 2019 14:57:46 GMT

Hi everybody,

my client uses a UF to forward Data from a Windows 2000 server. They try to collect Winevents.

Application
System
Security

The collection itself seems to work, but we only see Application logs in Splunk. For both other event logs we get:

WinEventLogChannel - init: Failed to bind to DC, dc_bind_time=9047 msec
WinEventLogChannel - Initialized Windows Event Log='Security' Success; oldest_rec_id='0'; newest_rec_id='0'; total_rec='0'

Which actually means that Splunk can not find any logs, but why?

Re: Problems with WinEvent collection on Windows2000 Server

adonio — Tue, 14 May 2019 00:19:25 GMT

imho its not supported

Re: Problems with WinEvent collection on Windows2000 Server

jbrocks — Tue, 14 May 2019 05:47:15 GMT

Thanks for you comment. I read similar, but I also read that Forwarding at least should work. As I said, we are just receiving Application Logs from that host - this works fine. But only no Security or System logs. (inputs.conf is fine)