Event Centralization

[areebasad]

Hello, i am trying to use a method to collect events from many servers to a centralized windows server 2008 (Collector) then i use the windows Eventing service to collect the events from the collector server and the forwarded events, all this had been successfully done, then i tried to create a correlated rule that filters events using the Event computer variable (the computer that generated the events) but no alert fires. i gone to the Message Viewer and check the events i found that the Event computer is exists. why the alerts does not fires?

[DavidDuarte]

Hello,

Did you succeed to resolve this correlated rule issue?

I try to collect the forwarded events logs using a windows server 2008 (collector).

I can see the security logs on the event viewer from the collector but the logs are not collected by enVision.

Do have an idea regarding this collection issue?

David

[areebasad]

Did you configured the Windows Eventing Collector service to collect Forwarding events subscription ?

this subscription contains all the forwarded events from the other servers with all types (System, Security, Application and all events you enabled in the forwarding configuration).