How can I ship Windows Server 2008 event logs to a syslog server?

Question

In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not mention support for Server 2008 but does mention problems with sending Windows Vista logs.

Are there any good services/utilities or even PowerShell scripts (preferably one of the other ones as this wouldn't be continuous) that could send the event logs to a central syslog server?

Answer 1

You could use Snare for Windows, a free software (freeware), released under the terms of the GNU Public Licence (GPL).

Snare for Windows Vista is a Windows 2008 and Windows Vista compatible service that interacts with the underlying "Crimson" Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for Windows Vista also support 64 bit versions of Windows (X64 and IA64).

Event logs from the Security, Application and System logs, as well as the new DNS, File Replication Service, and Active Directory logs are supported. The supported version of the agent also accommodates custom Windows event logs. Log data is converted to text format, and delivered to a remote Snare Server, or to a remote Syslog server with configurable and dynamic facility and priority settings.

Answer 2

I've used NTSyslog in the past. I was able to get all my windows machines to log to a central UNIX syslog server. Very handy.

Answer 3

Check this out: http://www.ashleyknowles.net/2009/10/windows-2003-2008-event-logging-to-syslog/

Answer 4

use Splunk. It's rather good