Windows Forwarder to read eventlog from another windows server

[anantdeshpande]

Hi Friends,

We have old 2003 Windows server where we can not install UF anymore. So we want to read EventLogs from Win 2003 server from another Win 2016 server where UF is running.

I have below monitor stanza in Win 2016 server. But not working. Any suggestions. 

[WinEventLog://\\<win2003_hostname>\config\Security]

[anantdeshpande]

Hi @Giuseppe,

We want to avoid WMI option and try configuring UF to access logs remotely. Do you have any solution with the approach.

[gcusello]

Hi @anantdeshpande,

as I said, I don't like WMI and I try to avoid it.

About remote access logs, what do you have to take: wineventlog or log files?

If log files, you could share the folders where these logs are stored and take them from another UF.

If wineventlog it's a problem because using an UF (or HF) you cannot take remote wineventlogs without WMI.

Did you already tried to use a newer UF (e.g. 7.x) even if it isn't supported?

Ciao.

Giuseppe

[anantdeshpande]

Hi @gcusello ,

We want to index wineventlog remotely via UF which is 7.x version. And it does not work when the monitor stanza is as below.

[WinEventLog://\\<win2003ServerHostname>\config\Security]

That is why I am looking for some suggestions on monitor stanza.

As you mentioned, Let me try WMI way.

[gcusello]

Hi @anantdeshpande,

the only way to monitor a remote wineventlog is WMI, it isn't possible to configure something like you tried.

My hint was different: did you tried to install a not supported UF 7.x on your Windows 2003 server? probably it runs and you have your wineventlogs.

This is the last try before WMI.

Ciao.

Giuseppe

[gcusello]

Hi @anantdeshpande,

you could use WMI (https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/MonitorWMIdata).

It's a solution that I use only when there isn't any other choice.

Ciao.

Giuseppe