I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes and Snare on the Windows ones, all pointing to a syslog-ng on linux.
Playing with the system, I realised that any network failure would cause the Windows event to be lost (Snare only use udp with syslog), so i tried WinAgents, with the same results
I tried switching to a Kiwi Syslog Server, and tried both Syslog and SNMP protocol on the WinAgents, with the same result.
Since both Kiwi and Syslog-ng can listen on TCP ports, there should be some Windows syslog client using tcp, right? Does anyone have any experience on such clients ?
Edit : I've been trying Centreon E2S, that supports both UDP and TCP, but does not seems to resend the message when there is a network failure