I'm facing below error while integrating windows server with SA.
1.) An error occurred creating an windows legacy connection:failed to open event log.
Kindly help/suggest on the same.
Usually the errors come with a code, if you check the logs via the SA ui there's usually a code (5 for access denied is common i.e. the credentials you are suing cannot access the event log).
One way to test permissions and access is to do a "run as" from your desktop and use the account that's configured in legacy collection to connect event viewer to the same remote system you are trying to collect from and see if it connects.
Also in the advanced settings of the event source make sure you are using remote registry as the protocol for discovery and not RMI,
Retrieving data ...