UF on Server 2012 R2 Not Pulling in WinEventLog Application

[jodros]

This is the first time I have tried running a UF on a server 2012 R2 box. Configuration is the same as my other win boxes. Config being pushed out with deployment server. However no wineventlogs are being sent. UF is 6.1.2. Config from deployment server:

[WinEventLog:Application]
checkpointInterval = 5
current_only = 0
disabled = false
index = app
start_from = oldest

Is this a bug?

[jodros · Accepted solution]

There was an existing props.conf entry on the indexers to drop wineventlog:application logs by default. Removed and it is working with original syntax. Sorry for the unneeded rabbit trail. Thanks for your time.

[linu1988]

Hello,
I think it is because of your syntax. Could you try the below?

[WinEventLog://Application]
disabled = 0
checkpointInterval = 5
current_only = 0
index = app

Thanks,
L

[jodros]

That was my first thought. However after reviewing I believe it is correct. My ds is linux. Verified that the config on the UF is [WinEventLog://Application]. I believe it gets translated. Also, that config on the ds is working on all other winOS boxes.

[linu1988]

Do you see any error? Is all the permissions given for reading the logs? Could you check if system/security logs work?

[jodros]

Added Security logs to be monitored. That works, however application logs are not working. I added security log monitoring by using this configuration on the ds:

[WinEventLog:Security]

Which translated to

[WinEventLog://Security]

On the winOS box. I don't know why application logs do not get indexed but security logs do? There are no errors that I can see specific to this issue.

Thanks

[jodros]

I also just upgraded the UF from 6.1.2 to 6.1.3. Issues still persists. I might try to install an older version of UF, possibly 5.x.

[linu1988]

they won't support 2012 as per the versions. Newer version should work. Fire a support case. I will try on one of my VM tomorrow to see if it works

[jodros]

The "5." by index is not in my config.