We currently use Nxlog on all of our DCs and send that data to a central syslog-ng server. Due to dealing with the agent on each computer and the need for additional agents that only support reading the event viewer, we are debating about using WEF to forward all DC logs to a few servers so we have fewer agents to deal with. In theory this sounds fine, but as I started to read into it, I don't see any ability for HA or clustering. I could probably front end it with a load balance and round robin spray the events to the 5 or so servers on the back end but not sure if that would work the way I want it to.

Does anyone have experience with using WEF in a fairly large environment? We receive around 200 million Windows event logs a day and need to increase the logging level. Also, we have the need for the logs to be as near real time as possible so with this scale, has anyone ran into performance issue on either the DC forwarding logs or latency of the collectors receiving them?

Thanks for your help and input.

  • The article below has some good information on how to setup an HA pair, but you would receive duplicates on each server instead of being a true round-robin type setup. This would work if you only care about HA, but I care about not getting dups as well so I don't think it'll do what I want it to do. (technet.microsoft.com/itpro/windows/keep-secure/…)
    – Eric
    May 2, 2016 at 16:55
  • not really answering your question, but have you tried using a config management system like [saltstack (free windows clients!), puppet, chef, etc] for provisioning the nxlog agents? In my past life, I used salt to deploy nxlog and configuration, it made it a snap to manage all the nxlog agents. Nov 22, 2016 at 22:25

2 Answers 2


I would highly recommend switching all your agents to elastic beats. I have used nxlog in the past and it simply does not do everything as nice as elastic beats have.

Plus they are written in GO so no dependancies needed.

Syslog-NG is great too, but I've since switched to logstash here as well, it supports clustering, failover, queues, and many exports different (like to graylog or splunk).

Lastly, we deploy our beats to windows and linux with Ansible.


You might want to consider a tool like Graylog (https://www.graylog.org/features) to manage and monitor your enterprise logging environment.

  • I think the asker really wanted some insight on the use of WEF - did you start using Graylog after running into issues with WEF (or pick it over WEF for a specific reason)? Mar 21, 2017 at 7:22
  • This is so not relevant to the question..
    – willemdh
    Apr 4, 2018 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .