Solarwinds Event Log Forwarder not forwarding all events

I am evaluating the Kiwi Syslog Server software, along with the Solarwinds Event Log Forwarder.  It seems to be working well so far, with the exception of one specific event I cannot seem to get to forward from a workstation to the server.  I am trying to forward Windows event ID 4608, "Windows is starting up".  For testing, in the log forwarder GUI, I created a subscription that selects every channel.  I created a filter at the syslog server that just shows all received messages on the display.  I am getting all of the other expected events, but not this specific one.  Is there something special about this event, or is there a different way I should be subscribing?

Parents Reply Children
  • I do not see any errors on the client side (looking in LogForwarderLog and LogForwarderService), or at the server (using the syslog gui).  I also looked through the Application events on the client machine event viewer, and did not see any errors related to this effort.  I also did not think to mention in the first post, the Event Log Forwarder is running on Windows 7 Professional, and Server is running in Windows Server 2008 R2.