Hey, thanks for your quick answer, but regarding to your answer you maybe misunderstood me, so i explain our situation more detailed: We got one Windowsserver which is configured as a Heavy Forwarder. He receive all the logs of our other Windowsserver(via WMI) and sends it to our third-party-system, which receive the logs and index/monitor them. It works properly as long as the indexserver on the third-party-system is running. If the indexer now goes down(for maintenance or other reason) and it start again after the downtime we dont get the logs, which occured during the downtime, so we think that the Heavy Forwarder dont cache them for any reason. The local Windows-Events of the server which runs the HF dont get lost, they just dont get send to the indexer(thanks for the edit but thats not the reason 😞 ). Now our goal is to cache the local Win-events and the Win-Event which he receive of the other servers as long as the indexer is down and than send it to the indexer if he´s online again. If we forward the logs to a other Win-server via tcp we got the same problems, that he dont store the local Win-events, am i right? ... View more