Windows eventlog can not be collected by Universal Forwarder

[jichen]

I have some windows machine to collect their eventlog, most of them works fine, but several of them can not send data to indexer server.
They're win2008R2 with same forwarder agent and configuration, the inputs.conf set as below
[WinEventLog:Application]
index=main
[WinEventLog:Security]
index=main
[WinEventLog:System]
index=main

I'm sure the network is fine,and the server also received the agent itself log in _internal database,but no windows log at all. I see the forwarder's log ,it record like something 'wmi.exe read 0.434 second, 0 byte read', but I'm sure there're plenty of events in the windows system. I clear the windows event log and restart the forwarder agent, the problem remains.
How to solve this issue, I think it's due to the windows OS itself,maybe the .DLL problem? Someone met the same problem?

[jichen]

Hi, I haven't done the troubleshooting yet, but I reinstall the agent and select the monitor option(security,system,application),then it's ok,but when I manually config the inputs.conf, no stuff indexed again.

[Ayn]

Not an answer per se, but some troubleshooting tips:
1. Use amrit's script to check what status Splunk has for each input. http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/
2. Check splunkd.log on the forwarder for hints on what could be wrong.

[Keysofsandiego]

Im still a newb myself but try adding the disabled switch to your inputs.conf.

[WinEventLog://Security]
disabled = 0
index = windows

[WinEventLog://Application]
disabled = 0
index = windows

[WinEventLog://System]
disabled = 0
index = windows

Also, you might want to make sure the outputs.conf is also configured too... example below.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = YOURSPLUNKSERVER:PORT

[tcpout-server://YOURSPLUNKSERVER:PORT]

Hope this helps.
Happy Splunking!
=)