windows - Event Log Forwarding does not display event message on collector -
yet microsoft issue or bug. can't seem forwarded event logs show message of event. following in details section:
the description event id xxx source ad fs auditing cannot found. either component raises event not installed on local computer or installation corrupted. can install or repair component on local computer. if event originated on computer, display information had saved event.
this happens on "non standard" events application (adfs in case).
some of action items have done:
made sure subscription in rendered text: wecutil ss "subscription name" /cf:renderedtext
copied dlls source servers application (adfs) , placed in collector server in same path
created registry key in hkey_local_machine\system\currentcontrolset\services\eventlog\forwarded events (note cannot create new event log accepted destination in creating subscription, windows limitation).
added registry keys each source/providers , registry values eventmessagefile pointing dlls
i tried converting renderedtext events in case above steps fixed it, did not.
can identify what's happening? don't understand why event log not forward message text syslog; seems unnecessary complication.
Comments
Post a Comment