We have worked around the issue by having the primary Universal Forwarder remotely collect WMI logs (wmi.conf) from the other machines on the local network. This does away with second-tier forwarders entirely.
We do however encounter occasional missing events or missing "Message" fields with this setup.
... View more