Microsoft ended Windows XP support in April 2014. If an ATM, a plant-floor HMI, or a lab instrument on your network still runs on Windows XP, your SOC and your auditors still need its logs. Current Splunk, Elastic, and IBM QRadar agents don’t install on Windows XP, and XP’s built-in TLS stack doesn’t support TLS 1.2. To work around both gaps, install NXLog Agent for 32-bit Windows on each Windows XP host and collect events with the Event Log for Windows XP/2000/2003 input module.

To forward Windows Server 2000, 2003, and 2008 event logs, run an agent on each server to read the events and send them over TLS to a relay or your SIEM. Windows 2000 and Server 2003 need a collector for the legacy Event Logging API, such as NXLog Agent’s Event Log for Windows XP/2000/2003 input module. Server 2008 and 2008 R2 need one for the newer Windows Event Log API, such as the Event Log for Windows input module.

We’ve released NXLog Agent 6.16.2 and NXLog Platform 1.15.1 in response to the compromise of eight eMudhra certificate authorities (CVE-2026-111943). If you use NXLog Agent to send data to cloud services over TLS, we recommend upgrading as soon as you can and making sure your operating system’s certificate bundle is up to date. We’re making this recommendation out of an abundance of caution. At this time, we’re not aware of this issue being exploited in the wild.

Key takeaways Microsoft retired the Log Analytics agent (MMA) on August 31, 2024, and can shut down its cloud ingestion services at any time after March 2, 2026. The Microsoft Azure Monitor Agent (AMA) runs only on 64-bit Windows Server 2016 or later and Windows 10 1803 or later. It won’t install on Windows Server 2008, Server 2003, or any 32-bit Windows. Windows Event Forwarding (WEF) and syslog forwarders help, but each has hard limits on these hosts.

Log fan-out, also called dual-shipping, sends one copy of each event to two or more SIEMs from a single collection point. Teams do it during SIEM migrations, when an MSSP and an internal SOC both need raw events, for compliance archives, and for regional SIEMs with different regulatory scope. Do the split at the agent or at a relay. A second forwarder on every host doubles your configuration work and gives you two event counts that do not match.

A log collector is software that gathers log data from hosts, applications, and network devices, parses and filters it, and forwards it to a SIEM, data lake, or log store. It runs as an agent on each host, as a central listener that devices send to, or both. A SIEM can only alert on events it receives. When a collector drops events during an outage or a burst, the SIEM gets no error, just fewer events.