Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Greg.

« Tuesday "Just for Fun": You Need a Laugh | Main | VM Optimizer (Really) Shrinks VM's »

Event Log Subscriptions in Windows Server 2008 (and Vista)

I've always had this love/hate affair with the Windows Event Log. Now long ago, I posted my own little list of gripes (about the old Event Log) and things I adore (about the new version).

One particular new feature about the new Event Log in Server 2008 (and also in Vista) is the ability to forward eventing information -- ol' school Syslog style -- to other computers. Why do this?

From my Windows Insider column this month in Redmond Magazine:

The idea is that some problems occur on multiple machines, so you may need to analyze log data from more than one computer for troubleshooting. If you consolidate events from each machine into a single log and sort it by time stamp, you'll get a better idea of what's going on. This type of analysis helps when you can't track down the precise nature of the problem.


For example, let's say you're having a problem between a Vista client and a machine running Windows Server 2008. Both systems are pumping data to their respective System Event logs, but you're having trouble aligning what's happening on each machine. In this case, you'll need to create a subscription on the server to inject system log data from the client into the server's system log.

The article goes on to discuss the specific steps necessary to set up forwarding between two W2008/Vista machines. The process isn't hard, but its not trivial either. It relies on the new WinRM (Windows Remote Management) service that's also new with Vista and W2008 -- and which may grace a future Windows Insider column if you keep your eyes open (hint, hint).

If you've always wanted your own little Syslog capabilities, check out the article at:
http://redmondmag.com/columns/article.asp?editorialsid=1868

TrackBack

TrackBack URL for this entry:
http://www.realtime-windowsserver.com/type/mt-tb.cgi/322

Comments

You can also use Splunk to collect and search Windows Event Logs across many windows machines on your network.

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Greg Shields' Bio:

Greg Shields, is an independent author, instructor, and IT consultant based in Denver, Colorado, and a co-founder of Concentrated Technology. With nearly 15 years of experience in information technology, Greg has developed extensive experience in systems administration, engineering, and architecture specializing in Microsoft systems management, remote application, and virtualization technologies. Greg is a Contributing Editor for Redmond Magazine, MCPmag.com, and Virtualization Review Magazine and is the author of five books, including Windows Server 2008:  What’s New / What’s Changed. Greg is also a highly sought-after instructor and speaker, speaking regularly at conferences like TechMentor Events, and producing computer-based training curriculum for CBT Nuggets.  Greg is a recipient of Microsoft "Most Valuable Professional" award with a specialization in Windows Terminal Services.