I'm looking at rolling out WEF in one of our new forests being built, and was wondering what would be the best way to structure the 'receiving' logs and subscriptions. I currently just have 4 logs I have created using https://blogs.technet.microsoft.com/russellt/2016/05/18/creating-custom-windows-event-forwarding-logs/ (DCs, servers, workstations, non-domain computers), and have just over 10 subscriptions where each is a category of event e.g. Windows firewall events, account and group activity events etc.
Is this the best way to do this? Would it be better to have the destination logs shadow the subscriptions? Maybe there is no right or wrong way, but perhaps someone is in a similar situation to me and has some pearls of wisdom?
To give you an idea of what this environment will be like - we have a total of 4 sites, each with about 100 - 150 workstations and servers. I will have a collector at each site that collects events for all computers at the site.
Thank you for the help