Need assistance on Log forwarding from UF

[Navanitha]

I am trying to forward win event security logs from server using UF to our Heavy forwarder.  UF has all the required apps configured however I only see its internal logs in tcpudmp on the Heavy forwarder and not the actual logs.

following is the config - 

[WinEventLog://Security]

_TCP_ROUTING=indexer1,indexer2

disabled = false

index=test

start_from = oldest

current_only = 1

evt_resolve_ad_obj = 1

checkpointInterval = 5

above inputs is standard across our org and few servers has outputs configured to indexer1, and some to indexer2, hence you see both in the outputs above.

outputs - 

[tcpout:indexer2_HF]

autoLB=true

server = 1.0.6.7:9997,1.0.6.8:9997

what else is missing ?

[livehybrid]

Hi @Navanitha 

Your _TCP_ROUTING should use the same value as the tcpout: value in outputs.conf
e.g.

_TCP_ROUTING=indexer2_HF

or, for both:

_TCP_ROUTING=indexer1_HF,indexer2_HF

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gcusello]

Hi @Navanitha ,

at first, it isn't clear why you are separating data between indexers, anyway the name in _TCP_ROUTING must be the same of the outputs.conf stanza, instead you have a different name: indexer2 instead of indexer2_HF.

Ciao.

Giuseppe