Forwarding Windows log event using TCP [closed]

Question

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes and Snare on the Windows ones, all pointing to a syslog-ng on linux.

Playing with the system, I realised that any network failure would cause the Windows event to be lost (Snare only use udp with syslog), so i tried WinAgents, with the same results

I tried switching to a Kiwi Syslog Server, and tried both Syslog and SNMP protocol on the WinAgents, with the same result.

Since both Kiwi and Syslog-ng can listen on TCP ports, there should be some Windows syslog client using tcp, right? Does anyone have any experience on such clients ?

Many thanks

Edit : I've been trying Centreon E2S, that supports both UDP and TCP, but does not seems to resend the message when there is a network failure

Answer 1

You'll have to fork over some cash, but syslog-ng's "premium edition" has a Windows agent (see here)

Answer 2

Take a look at nxlog, it supports TCP and SSL too. It's open-source and works on both Linux and Windows.

Answer 3

I haven't used it, but it looks like the Adiscon EventReporter application will do what you're looking for.

Answer 4

We're using LogZilla (http://www.logzilla.pro) with our windows boxes. The windows systems use Snare to forward logs to our LogZilla server. We like it because it is blazing fast for searches and charts (and we log over 100 million events a day), plus it costs WAYYYY less than Clunk (splunk) and the user interface is easy enough for our managers to use, lol.

Answer 5

I got it working using Kiwi in combination with STunnel.

• Set kiwi up to forward using Http to a certain port on localhost
• Set stunnel up to listen to that port and forward to your syslog server

The stunnel config would be something like:

[Syslogs]
client = yes
accept = 127.0.0.1:1234
connect = 1.2.3.4:5678

where 1.2.3.4:5678 would be the ip:port of your syslog server (and kiwi would be forwarding to localhost:1234).

Still looking for a replacement for Kiwi/SolarWindsLogForwarder for Windows though... It must send Http instead of UDP to work correctly with stunnel.