Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application that logs app specific data to rotated log files. There are several servers doing their own logging, and I would like to aggregate these somehow into a central data store.

How is this typically done in Windows? How often should the aggregator service do its thing?

share|improve this question

If you are referring to the Windows Event Log facility proper, there is a built-in capability to create subscriptions and designate specific machines as collectors. The subscriptions can be push or pull, and uses an XQuery/XPath syntax.

If you want to forward other types of data, you may want to look into Snare or some other Windows log mechanism. Snare has been around forever, there are agents and servers, and is open source:

If it is not a Windows event log, you may be interested in the "Epilog" Windows agent.

Frequency is dependent on requirements and available network resources. If everything is on a local LAN, network resources aren't as important. For the built-in Windows event forwarding, I would not collect events more often than 30 minutes, unless it is for an urgent security or financial purpose. Typically if the event log has not rolled over, events will not be missed. Snare is a different beast. I'm not sure of the scheduling or throttling capabilities. Our Snare agents are used for relaying security auditing information, so they are constantly streaming syslog data back to the collectors. Syslog is usually UDP, so this may not be as reliable as the Windows event subsystem for Windows security audit messages.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.