Forwarded Event Logs

Question

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only events going forward that will be logged?

Answer 1

You can try this:

WECUtil SS "SubscriptionName" /cm:custom /ree:true

This should be done before the Subscription is started. In other words, after you create the subscription disable it, then run the above command, then renable it. The list will then populate

http://blog.zenshaze.com/2011/06/13/event-forwarding-of-security-logs/

Answer 2

Add this:

<ReadExistingEvents>true</ReadExistingEvents>

To your subscription xml-configuration file, inside the <Subscription> tag