Soo I have been able to setup and create the different monitors for my universal forwarder. Im working in a test environment so I dont need ssl, however I am attempting to monitor change to a ubuntu 16.04 via the universal forwarder. the data is pretty sparse, i initially thought it was because there is no user interaction. Now I get some logs but i also get a 500 internal web error . any idea on the cause of this ? and why am I not getting the logs from tmp or user access logs ?
