Unable to Forward Security Audit Events

Hi All, First time posting here. I am using the Event forwarder along with Kiwi Syslog server. On my DC, System and Application events are forwarding just fine, but I can't get Security Alerts to forward to the syslog server. Specifically, I want to forward events associated with the changing of security groups. I've attached a screenshot of my setup. Am I missing something obvious? I've uninstalled, reinstalled, and recreated system cfg file, still no luck. 

  • I usually start troubleshooting by removing any filters and forwarding all events.  Once I have verified that the events are making it to the syslog server(s) I will start to add filters.  Nothing looks wrong with the forwarder config but I haven't used that in quite a while.