I'm running an enterprise indexer on windows, and after an infrastructure admin pushed a UF update to all hosts the indexer is now only ingesting XmlWinEventLog events from itself, all other hosts including other enterprise servers like SH and LM DM etc are still forwarding only classic winevents. I have uninstalled the forwarder from the indexer, restarted the server, and verified there are no renderxml = true statements in any conf files, and there are no [XmlWinEventLog://Security] stanzas but the ONLY security logs I get from this one host are xml events. I have used btool to search the entire config, exported the results to notepad++ for searching, and restarted the server to no avail. This one server just insists on ONLY processing xmlwineventlogs, so it fails to show in any reports or dashboards we have setup for other hosts. ... View more