This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Cannot create Subscription in Event Log Forwarder for Windows

I just downloaded the latest version of your free tool Windows Event Log Forwarder and then installed on a Windows 2008 Server with no issues after installing .NET Framework 4.0 but when I try and add a subscription to any event log like Application, System, Security, etc the "Task Category" drop down will not populate, it just gets stuck on "loading ....".   I waited over an hour and it still did not populate.

If was able to create a subscription if I chose Microsoft-Windows-Backup logs but it get's stuck on "loading..." the Task Category if I choose any of the Event Logs.

I know some event logs can be big.  Mine are set to store 1Gb but it should not take over an hour to populate the "Task Category" section.

This looks like a bug in this version of software.

Is there a workaround or an older version this does not happen with?

  • I found other THWACK posts about this software where several users were having issues.  For example:

    Re: Event Log Forwarder - Where is the Audit Failure Type?

    And some suggestions were to use the older version 1.9 as version 1.2 was buggy

    So I tried version 1.9 and then keep getting this error every time I try and create a subscription and select the Security log:

          The event subscription is either too complex, or invalid

         [15001] The specified query is invalid

    I found this support article referencing this error:

    Invalid subscription when setting up Log Forwarder - SolarWinds Worldwide, LLC. Help and Support

    Its resolution is to change the account used by the SolarWinds Log Forwarder to a domain account with administrative permissions.

    -- so I tried changing the LogForwarder service to run as a domain account with admin permissions and still get same error

    -- I also tried running the LogForwarder client GUI as administrator but still get same error.

    At this point I have wasted 2 days trying to get this buggy software to send my Security Event Logs from my Windows 2008 domain controller over to the Kiwi Syslog server running on another Windows 2008 server.

    !!!! SolarWinds should be ashamed of themselves for releasing such a crappy software and not supporting it because it is a free version !!!!

    In the other support article I posted above the SolarWinds product manager (bshopp) said:


         Great that they said that to you, but I am the Product Manager for this and since Log Forwarder comes with Syslog, I get to make the call on if we fix it or      not.  Can you send me the ticket number and I will look into this on my side.

    But as you scroll down you see this issue was never resolved and one of the lasts posts was to use version 1.9 which does not work as well.