subscription option not available for remote event viewer

Question

I've got a Server Core 2016 installation I'm trying to configure as an event log collector. I've successfully enabled the firewall rules, however, when I connect to event viewer remotely through MMC, I can't see the subscriptions node. It seems that subscriptions can't be configured through MMC remotely

Since there's no PowerShell way of creating persistent subscriptions, how can this be configured on server core? It seems it requires the GUI installed

Answer 1

Subscriptions can be created manually with wecutil. To create a remote subscription using event viewer, first configure the subscription remotely, then export it using wecutil gs [subscription name] /f:xml. The subscription can be imported using wecutil cs [subscription.xml]. There are a few caveats:

• At the time of writing, you must remove the XML declaration from the generated config file
• The generated config file will use <ConfigurationMode>Normal</ConfigurationMode>. This should be changed to custom to avoid generating a warning. This is because a <Delivery> node is created. If you leave the value as Normal, remove the <Delivery> tag. The values are mutually exclusive. See here.