I have turned this particular Universal Forwarder off ( it is for testing), however I continue to receive WinEvents from this server.
There is not a wmi.conf in any of the inputs for this forwarder. I have the forwarder service disabled and the outputs.conf has been renamed, and all of the monitor stanzas have been set to disabled.
How can I stop receiving the WinEvents (this is an extra 40 MB/day that I don't need indexed)?
... View more