I am evaluating the Kiwi Syslog Server software, along with the Solarwinds Event Log Forwarder. It seems to be working well so far, with the exception of one specific event I cannot seem to get to forward from a workstation to the server. I am trying to forward Windows event ID 4608, "Windows is starting up". For testing, in the log forwarder GUI, I created a subscription that selects every channel. I created a filter at the syslog server that just shows all received messages on the display. I am getting all of the other expected events, but not this specific one. Is there something special about this event, or is there a different way I should be subscribing?
