Event Forwarder Facility Level?

Question

Hi folks,

I've just installed and trialled the event forwarder for Windows Servers. I like the initial look but I have a concearn over the amount of traffic this will generate from my remote sites to my main Data Centre where the syslog/orion server sits.

I know I can filter out events on the syslog server but can I filter out the events before they go over my WAN links? Would changing the facility on the "Message Details" tab on the event forwarder do it, if so to what level?

I'm probably only really interested in Critical and Emergency logs, no informational or warning.

thanks

Dave

chris.lapoint · Answer

We're working on an updated Log Forwarder beta version that includes:

* Support for Windows XP/2000
* Support for Vista/2008
* Fully extensible filtering of Events
* Silent install support using MSI (e.g. for use with Microsoft SMS)

If you're interested in participating in the beta, please sign-up here:

http://www.surveymonkey.com/s.aspx?sm=DynVwW6JTdOuBkSoR_2fLNnw_3d_3d

DirtySouth · Answer

Daveh, did you ever get any information on this? I have not used Windows Event Forwarder yet and am concerned about bandwidth as well. Did you find out if there was a way to prune events at the server rather than only at the syslog viewer?

Habakkuk3_17-19 · Answer

what's your experience been with using the forwarder so far?

i need some way to know all the servers logged into from a domain user account.

so i am wondering if this Event Forwarder to Solarwinds SYSLOG console would be the solution and then perhaps use SQL Reporter to build reports.

anybody out there using something different or have a solution or have any ideas or ...