When I set up the Log Forwarder for Windows, I don't see the Event ID being transmitted to our Orion server.. just the event text. This makes it difficult to set up precise alerts and searches for specific logged events. I've started using key words from the log message, but I wonder how long before I start getting unintended hits on events with similar messages. Hopefully I'm doing something wrong.. this seems like such a basic function of log management. Any suggestions?
