Windows eventlog forwarding

Troubleshooting
1

Hello,

my goal should be that all Windows domain controllers eventlogs from “Directory Services” forward to the Event console in tactical overview. I configured Logwatch Event Console Forwarding in WATO with
“forward messages to event console”. The “list of expected logfiles” shows in the parameters all event logs just like Powershell, KMS, Hardware, Active Directory and so on,

The problem is that only event logs entries from Application or Security is forward to EC but nothing from “Directory Services”.

What I have to configure or what I have made wrong?

Thanks for any help!!
Timo

2

Hello,
do you have a rule “Finetune Windows Eventlog Monitoring” in Monitoring Agents?

Karl

3

No. What I have to configure there?

Are my “first steps” the right way ? :slightly_smiling_face:

4

Hi,
if you deactivate the forwarding and do a full scan on your windows machine … what log files are discovered by Checkmk?

Karl

5

Hi,

The needed logs; Log Active Directory Web Services, Log DFS Replication, Log DNS Server

Timo

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.