Forwarding Windows log event using TCP

Question

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes and Snare on the Windows ones, all pointing to a syslog-ng on linux.

Playing with the system, I realised that any network failure would cause the Windows event to be lost (Snare only use udp with syslog), so i tried WinAgents, with the same results

I tried switching to a Kiwi Syslog Server, and tried both Syslog and SNMP protocol on the WinAgents, with the same result.

Since both Kiwi and Syslog-ng can listen on TCP ports, there should be some Windows syslog client using tcp, right? Does anyone have any experience on such clients ?

Many thanks

Edit : I've been trying Centreon E2S, that supports both UDP and TCP, but does not seems to resend the message when there is a network failure

Answer 1

You'll have to fork over some cash, but syslog-ng's "premium edition" has a Windows agent (see here)

Answer 2

I haven't used it, but it looks like the Adiscon EventReporter application will do what you're looking for.

Answer 3

Take a look at nxlog, it supports TCP and SSL too. It's open-source and works on both Linux and Windows.

Answer 4

We're using LogZilla (http://www.logzilla.pro) with our windows boxes. The windows systems use Snare to forward logs to our LogZilla server. We like it because it is blazing fast for searches and charts (and we log over 100 million events a day), plus it costs WAYYYY less than Clunk (splunk) and the user interface is easy enough for our managers to use, lol.