How to edit my universal forwarder monitor stanza to index Active Directory server logs?

[anaqvi]

I am trying to monitor the Active Directory Server for logs. I have a universal forwarder installed on a Windows AD Server, and there are logs at the following path:

%SystemRoot%\System32\Winevt\Logs\

How can I monitor it? I have tried the following, but it does not work:

[monitor://%SystemRoot%/System32\Winevt\Logs]
targetDC = hqdc06
baseline = false
disabled = 0
index = wineventlog
renderXml=false
Sourcetype = Active Directory

[gcusello]

Hi anaqvi,
probably the problem is the slash (/) after %SystemRoot%.
Every way, aren't you able to define %SystemRoot%?

Bye.
Giuseppe