topic Re: Windows Forwarder to read eventlog from another windows server in Getting Data In

Windows Forwarder to read eventlog from another windows server

anantdeshpande — Tue, 01 Jun 2021 11:02:59 GMT

Hi Friends,

We have old 2003 Windows server where we can not install UF anymore. So we want to read EventLogs from Win 2003 server from another Win 2016 server where UF is running.

I have below monitor stanza in Win 2016 server. But not working. Any suggestions.

[WinEventLog://\\<win2003_hostname>\config\Security]

Re: Windows Forwarder to read eventlog from another windows server

gcusello — Tue, 01 Jun 2021 11:06:43 GMT

Hi @anantdeshpande,

you could use WMI (https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/MonitorWMIdata).

It's a solution that I use only when there isn't any other choice.

Ciao.

Giuseppe

Re: Windows Forwarder to read eventlog from another windows server

anantdeshpande — Tue, 01 Jun 2021 11:44:20 GMT

Hi @Giuseppe,

We want to avoid WMI option and try configuring UF to access logs remotely. Do you have any solution with the approach.

Re: Windows Forwarder to read eventlog from another windows server

gcusello — Tue, 01 Jun 2021 12:40:19 GMT

Hi @anantdeshpande,

as I said, I don't like WMI and I try to avoid it.

About remote access logs, what do you have to take: wineventlog or log files?

If log files, you could share the folders where these logs are stored and take them from another UF.

If wineventlog it's a problem because using an UF (or HF) you cannot take remote wineventlogs without WMI.

Did you already tried to use a newer UF (e.g. 7.x) even if it isn't supported?

Ciao.

Giuseppe

Re: Windows Forwarder to read eventlog from another windows server

anantdeshpande — Tue, 01 Jun 2021 14:27:43 GMT

Hi @gcusello ,

We want to index wineventlog remotely via UF which is 7.x version. And it does not work when the monitor stanza is as below.

[WinEventLog://\\<win2003ServerHostname>\config\Security]

That is why I am looking for some suggestions on monitor stanza.

As you mentioned, Let me try WMI way.

Re: Windows Forwarder to read eventlog from another windows server

gcusello — Tue, 01 Jun 2021 14:33:03 GMT

Hi @anantdeshpande,

the only way to monitor a remote wineventlog is WMI, it isn't possible to configure something like you tried.

My hint was different: did you tried to install a not supported UF 7.x on your Windows 2003 server? probably it runs and you have your wineventlogs.

This is the last try before WMI.

Ciao.

Giuseppe