Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys ( It does not mention support for Server 2008 but does mention problems with sending Windows Vista logs.

Are there any good services/utilities or even PowerShell scripts (preferably one of the other ones as this wouldn't be continuous) that could send the event logs to a central syslog server?

share|improve this question
Not sure if 2008 logs are different enough to warrant a merge, but see also – Kara Marfia May 31 '09 at 14:06
@Kara: that question is about syslog servers, this one is about clients to send data to the syslog server. Related, but not the same. – Stobor Aug 1 '11 at 3:53
up vote 6 down vote accepted

You could use Snare for Windows, a free software (freeware), released under the terms of the GNU Public Licence (GPL).

Snare for Windows Vista is a Windows 2008 and Windows Vista compatible service that interacts with the underlying "Crimson" Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for Windows Vista also support 64 bit versions of Windows (X64 and IA64).

Event logs from the Security, Application and System logs, as well as the new DNS, File Replication Service, and Active Directory logs are supported. The supported version of the agent also accommodates custom Windows event logs. Log data is converted to text format, and delivered to a remote Snare Server, or to a remote Syslog server with configurable and dynamic facility and priority settings.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.