1

I'm looking at rolling out WEF in one of our new forests being built, and was wondering what would be the best way to structure the 'receiving' logs and subscriptions. I currently just have 4 logs I have created using https://blogs.technet.microsoft.com/russellt/2016/05/18/creating-custom-windows-event-forwarding-logs/ (DCs, servers, workstations, non-domain computers), and have just over 10 subscriptions where each is a category of event e.g. Windows firewall events, account and group activity events etc.

Is this the best way to do this? Would it be better to have the destination logs shadow the subscriptions? Maybe there is no right or wrong way, but perhaps someone is in a similar situation to me and has some pearls of wisdom?

To give you an idea of what this environment will be like - we have a total of 4 sites, each with about 100 - 150 workstations and servers. I will have a collector at each site that collects events for all computers at the site.

Thank you for the help

Improve this question
0

I haven't seen much value in structuring collector custom forwarded event logs to match the subscriptions. That kind of custom configuration and linkage would require maintenance and be a headache.

Forwarded event logs are intended to be temporary staging areas where the events are processed by automation after collection for saving in a database and/or alarming/notification. They can also be huge - 10's of GB, with no impact on processing performance, due to they are circular binary logs. The one exception for performance is the graphical event viewer, but forwarded logs aren't intended for using the graphical event viewer.

PowerShell Get-WindowsEvent or .NET custom code to quickly extract the events needed to a CSV or XML file, based on filtering by date/time and event criteria, using event XML query filters.

I haven't see any prescriptive guidance on the number of subscribers per collector, probably because it depends on the volume. But I have one collector and the default forwarded events log with more subscribers than the scenario you describe, that collects millions of events per day and isn't close to capacity.

Where a separation of concerns is truly necessary, I would recommend turning up a separate collector. Virtual servers and storage are inexpensive.

Improve this answer
  • Thanks for the reply. I was thinking that it would probably be best just chucking it all in the one log but wasn't sure about how much of a pain this would be to process. Presumably Powershell processes logs quite quickly? Also, 1GB appears to be the recommended max size for the log before archiving; is this simply due to the poor GUI performance? – Stuart475898 Jun 18 '17 at 14:04
  • I've never seen a maximum size recommendation for the forwarded event log. I have collectors with a 50 GB forwarded event log, with no impact on processing performance. – Greg Askew Jun 18 '17 at 14:24
  • Nice. Forwarded events log it is then! Thanks for the help – Stuart475898 Jun 18 '17 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.