Universal Forwarder only sends monitored log file once per restart...

[nabeel652]

I have a universal forwarder installed on my Print Server (Windows 2012 R2). I used WinPrintMon but it is giving some funny results. However, I am able to pull out printer logs through pointing directly to the file c:\windows\system32\winevt\logs\microsoft-windows-printer%4operational. However, the forwarder only sends once the logs when restarted. After that it will not send any logs until restarted.

[acharlieh]

Why are you using a monitor stanza instead of a WinEventLog stanza similar to: http://answers.splunk.com/answers/124859/unable-to-index-microsoft-windows-printservice-operational....

[richgalloway]

What are your inputs.conf settings?

[nabeel652]

Thanks buddy, adding WinEventLog stanza solved my problem Cheers 🙂

[nabeel652]

[monitor://c:\windows\system32\winevt\logs\Microsoft-Windows-PrintService%4Admin]
disabled=false
index=printmon

I've also tried with MonitorNoHandle but in that case the forwarder doesn't send data at all.