Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only events going forward that will be logged?

share|improve this question
add comment

2 Answers

You can try this:

WECUtil SS "SubscriptionName" /cm:custom /ree:true

This should be done before the Subscription is started. In other words, after you create the subscription disable it, then run the above command, then renable it. The list will then populate

http://blog.zenshaze.com/2011/06/13/event-forwarding-of-security-logs/

share|improve this answer
    
This did the trick. Thank you very much –  Rome Feb 8 '12 at 21:41
add comment

Add this:

<ReadExistingEvents>true</ReadExistingEvents>

To your subscription xml-configuration file, inside the <Subscription> tag

share|improve this answer
    
What's the path to the XML? :D –  Rome Feb 8 '12 at 21:01
    
the one you used to initiate your subscription ;-) wecutil cs configfilename.xml <-- that one –  Mathias R. Jessen Feb 8 '12 at 21:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.