I have the event log forwarder setup on a Windows 2016 server. I have it set to send only two event IDs that are frequently recurring. It appears that the service will only send a batch of logs immediately when the service is restarted, but nothing after that. I have this in use on about 100 endpoints and I've never seen this behavior. There is no firewall or AV in the way. The subscription preview shows the logs. Log entries are definitely being generated in the Windows event logs. Is there anywhere I can look to troubleshoot. Can I turn on debug logging in the Log Forwarder service?