• State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 22 subscribers
  • Views 299 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Feature Request - Connector/Tool for Syslogs from Windows Log Forwarder client

Sohail.Bhamani

A customer I am working with this week had a need to monitor windows servers for *any* error event in the Application and System event logs.  I traded some emails with Cheryl Nomanson about this but was unable to find a field which would be used to clue in on this wildcard type of event search.  I thought that since the Log Forwarder for Windows client can forward event log entries into Orion as syslog, it would be nice to send those syslogs to LEM.  I set this up but then realized there is no connector for this available in LEM that I know of.

So, a LEM connector which can normalize Log Forwarder for Windows syslog's would be pretty nice and open up a number of items in relation to wildcard searches for folks who need this for some compliance need.

Thanks!

Sohail Bhamani

Field Engineer

Loop1 Systems

http://www.loop1systems.com

  • FormerMember
    0 FormerMember

    Thanks, we've just heard this request (to integrate the Windows log forwarder syslog messages, not just have our out-of-the-box integration) once or twice now, and are keeping an eye on it. We would still be normalizing and parsing the data, so we'd need to take into account your other request for something generic.

    That said...  I think we already have what you need. The Windows Application & System Log connectors do pass through ALL events that are "Error" or "Warning". The EventInfo for a "warning" event will say "<Source> Warning"  (e.g. W32Time Warning) and the WarningMessage will contain the details (the ProviderSID, as always, has the Source and EventID). For an "error" it'll be the same, except it'll say "<Source> Error". Both are categorized as ServiceWarning alert types.

  • 0 in reply to FormerMember

    Excellent!  Thanks for the reply!

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.