Event Log Forwarder - Where is the Audit Failure Type?

Because of changes in the security event logs starting with Windows 2008, you will find these options under the Keywords section:

I have my client setup exactly like that and it doesn't seem to work.  In fact, when I setup a subscription for the Security log the service won't start.  If I delete the subscription it starts again.  Application and System logs work perfectly.

Here is the error message I get when the service won't start.

3/19/2015 9:54:38 AM - Unable to setup Windows Event Log subscribers.  Subscribe failed with error 15001, The specified query is invalid.

3/19/2015 9:54:38 AM - Server Initialization Failed.  See previous event messages for reason.

3/19/2015 9:54:38 AM - SolarWinds Event Log Forwarder for Windows; Service Stopped.

Are you selecting only the Security event log?

Yes, I added it as a separate subscription that only has the Security log.  It appears that it breaks when I add the "Audit Failure" keyword.  If I select nothing for the keywords it works as expected, the service starts and I get everything including success and failure syslogs.  As soon as I add the Audit Failure keyword the service won't start.  Removing it starts again.  One thing to note is that I am running the latest version 1.20.

What operating system are you running Log Forwarder on?  I will do some testing.

Windows 2012 R2

It doesn't seem to work on Windows 2008 R2 either.

As a test, can you save and clear the security .evtx file, and then try adding the subscription?

I cleared it and it still breaks.  No change.

Try going int the .\SolarWinds\SolarWinds Log Forwarder for Windows directory and delete the LogForwarderSettings.cfg file.  Then re-enter your syslog server IP, and recreate the subscription.