log forward from windows Servers to syslog vm

Question

Hello,

I'm seeking for a method to forward all the relevant logs on my windows Servers in order to send them to a centralized syslog VM.

Are there any methods to log forward the logs automatically on windows Servers?

Answer 1

You can configure Windows Event Forwarding on your servers to send all the logs to a collector, the logs will show up in the collector in the Event Viewer -> Forwarded Events logs.

From there, you can use an agent that will access the Forwarded Events log on the collector and transmit all the data to the Syslog server (for example, Winlogbeat -> LogStash -> Syslog).