When you see an WinEventMon:: error stating it is unable to find the Log with channel name="foo" often means the the Event Log Name is named differently then what is configured in your forwarder's inputs.conf stanza.
Also the "File Replication Service" is considered a non-default Windows event log. You must import them to the Windows Event Viewer.
After you import the log, you can add them to your forwarder's local copy of inputs.conf , as follows:
[WinEventLog://File Replication Service]
disabled = 0
This may fix both problems, if not double-check your Regex statement for accuracy.
A issue I had was I needed to monitor workstation cdrom usage. For my forwarder's inputs.conf is was using the following stanza:
[WinEventLog://Microsoft-Windows-CDROM]
disabled = 0
But if you take a look at the logs using poweshell: Get-WinEvent -ListProvider cdrom you see:
PS C:\> Get-WinEvent -ListProvider cdrom
Name : cdrom
LogLinks : {System}
Opcodes : {}
Tasks : {}
Name : Microsoft-Windows-CDROM
LogLinks : {Microsoft-Windows-CDROM/Operational}
Opcodes : {win:Info}
Tasks : {CDROM_DRIVER}
Looking at the LogLinks, I see I needed to use the System log and proper event codes. Changed my stanza to reflect looking at the system log and to blacklist all but the code i wanted:
[WinEventLog://System]
disabled=0
blacklist1= 0-112,114-99999
Regards,
Michael Stillmunks
... View more
