Getting Data In

UF on Server 2012 R2 Not Pulling in WinEventLog Application

Builder

This is the first time I have tried running a UF on a server 2012 R2 box. Configuration is the same as my other win boxes. Config being pushed out with deployment server. However no wineventlogs are being sent. UF is 6.1.2. Config from deployment server:

[WinEventLog:Application]
checkpointInterval = 5
current_only = 0
disabled = false
index = app
start_from = oldest

Is this a bug?

0 Karma
1 Solution

Builder

There was an existing props.conf entry on the indexers to drop wineventlog:application logs by default. Removed and it is working with original syntax. Sorry for the unneeded rabbit trail. Thanks for your time.

View solution in original post

0 Karma

Builder

There was an existing props.conf entry on the indexers to drop wineventlog:application logs by default. Removed and it is working with original syntax. Sorry for the unneeded rabbit trail. Thanks for your time.

View solution in original post

0 Karma

Champion

Hello,
I think it is because of your syntax. Could you try the below?

[WinEventLog://Application]
disabled = 0
checkpointInterval = 5
current_only = 0
index = app

Thanks,
L

0 Karma

Builder

That was my first thought. However after reviewing I believe it is correct. My ds is linux. Verified that the config on the UF is [WinEventLog://Application]. I believe it gets translated. Also, that config on the ds is working on all other winOS boxes.

0 Karma

Champion

Do you see any error? Is all the permissions given for reading the logs? Could you check if system/security logs work?

0 Karma

Builder

Added Security logs to be monitored. That works, however application logs are not working. I added security log monitoring by using this configuration on the ds:

[WinEventLog:Security]

Which translated to

[WinEventLog://Security]

On the winOS box. I don't know why application logs do not get indexed but security logs do? There are no errors that I can see specific to this issue.

Thanks

0 Karma

Builder

I also just upgraded the UF from 6.1.2 to 6.1.3. Issues still persists. I might try to install an older version of UF, possibly 5.x.

0 Karma

Champion

they won't support 2012 as per the versions. Newer version should work. Fire a support case. I will try on one of my VM tomorrow to see if it works

0 Karma

Builder

The "5." by index is not in my config.

0 Karma