Hi There,
I'm trialing Kiwi Syslog and I'm having trouble with the Log Forwarder and Security Event Log. When I click on the Security Log I don't see Audit Success or Audit Failure as an event type. It just has Error, Warning and Information. If I manually edit the CFG file and add <int>16</int> it works, but then it gets overwritten if I make a change. Am I doing something wrong? How can I see Audit Failure as an Event Type?
Thanks,
Because of changes in the security event logs starting with Windows 2008, you will find these options under the Keywords section:
Yes, I added it as a separate subscription that only has the Security log. It appears that it breaks when I add the "Audit Failure" keyword. If I select nothing for the keywords it works as expected, the service starts and I get everything including success and failure syslogs. As soon as I add the Audit Failure keyword the service won't start. Removing it starts again. One thing to note is that I am running the latest version 1.20.
