Security Compliance
SEM - Windows Event Forwarding
First published date
Last published date
Overview
When attempting to collect events from a Windows machine it is recommended to use the SEM agent that we have. It will collect logs from the 3 primary Windows Event logs (Application, Security, System) by default, and allow the Active Connector for rule actions. This agent can be deployed using a remote installer/uninstaller that allows large installs to be handled from a single machine.
Product section
Resolution
In situations where the agent is not wanted, it is possible to set up Windows Events to be forwarded to the SEM instead. This is not the recommended deployment, but in the situation when an agent is not an option you can use the Event Log Forwarder for Windows tool to forward Windows Events to the SEM. You would then use the Windows syslog Manager Connectors to normalize the syslog data into Events. Here is the link to the site for the free forwarding tool.
https://www.solarwinds.com/free-tools/event-log-forwarder-for-windows
And here is the link to its admin guide.
Other Notes
When the SEM receives forwarded events, it attempts to determine the original logging device in some cases. If the SEM recognizes the detection IP correctly then it will add a node for that IP address if one does not already exist, consuming a license. In this way there is not expected to be a difference in licensing between forwarding or not forwarding, unless the forwarding device consumes an extra license.
The syslog connectors for Windows events are designed to receive logs in standard syslog format. It requires that the Windows events that are sent to the SEM are first structured to a single line per log. If the events arrive at the SEM on multiple lines then the connector will not be able to normalize the logs.
The supported method of receiving logs to the SEM from Windows devices is using the Agent. Any trouble with using the agent is something that you can contact Solarwinds Support for assistance with. If you need assistance with our free tools like the Event Log Forwarder it is recommended that you consult that Admin Guide and the Thwack community for further information on those tools.