The Universal Forwarder and Server 2008 Event Logs

[peasead]

Server 2008 has several different event logs beyond Security, System, and Application.

The Universal Forwarder only has those three check boxes (Security, System, and Application)...do you just add the additional logs as a monitored directory or file?

Are there any talks about a Server 2008 version that has all the additional log types?

[Ayn · Accepted solution]

Those are just the default ones. You can certainly add any log sources you want by adding it in yourself in an inputs.conf file. Have a look at the default ones in etc\apps\MSIcreated\default\props.conf (or might it be local? I forget) and use those as templates. Simplest case for adding an eventlog with the name foo, for instance, would be to add this to an inputs.conf:

[WinEventLog:foo]