Server 2008 has several different event logs beyond Security, System, and Application.
The Universal Forwarder only has those three check boxes (Security, System, and Application)...do you just add the additional logs as a monitored directory or file?
Are there any talks about a Server 2008 version that has all the additional log types?
Those are just the default ones. You can certainly add any log sources you want by adding it in yourself in an inputs.conf
file. Have a look at the default ones in etc\apps\MSIcreated\default\props.conf
(or might it be local
? I forget) and use those as templates. Simplest case for adding an eventlog with the name foo
, for instance, would be to add this to an inputs.conf
:
[WinEventLog:foo]
Those are just the default ones. You can certainly add any log sources you want by adding it in yourself in an inputs.conf
file. Have a look at the default ones in etc\apps\MSIcreated\default\props.conf
(or might it be local
? I forget) and use those as templates. Simplest case for adding an eventlog with the name foo
, for instance, would be to add this to an inputs.conf
:
[WinEventLog:foo]