This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Unable to Forward Security Audit Events

Hi All, First time posting here. I am using the Event forwarder along with Kiwi Syslog server. On my DC, System and Application events are forwarding just fine, but I can't get Security Alerts to forward to the syslog server. Specifically, I want to forward events associated with the changing of security groups. I've attached a screenshot of my setup. Am I missing something obvious? I've uninstalled, reinstalled, and recreated system cfg file, still no luck. 

  • I usually start troubleshooting by removing any filters and forwarding all events.  Once I have verified that the events are making it to the syslog server(s) I will start to add filters.  Nothing looks wrong with the forwarder config but I haven't used that in quite a while.