Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only events going forward that will be logged?

share|improve this question

You can try this:

WECUtil SS "SubscriptionName" /cm:custom /ree:true

This should be done before the Subscription is started. In other words, after you create the subscription disable it, then run the above command, then renable it. The list will then populate

share|improve this answer
This did the trick. Thank you very much – Rome Feb 8 '12 at 21:41

Add this:


To your subscription xml-configuration file, inside the <Subscription> tag

share|improve this answer
What's the path to the XML? :D – Rome Feb 8 '12 at 21:01
the one you used to initiate your subscription ;-) wecutil cs configfilename.xml <-- that one – Mathias R. Jessen Feb 8 '12 at 21:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.