agentless log forwarding error using im_wseventing module

View thread

AH_601191
Hello Guys, Im currently trialing nxlog enterprise version and specifically interested in agentless version of it. While working on it i have come across a blockade which seems to not forward logs from windows server machine to linux windows event collector(nxlog enterprise version is running). Im running nxlog version 5.1.6133 on ubuntu. Here are the details (SERVER details w.r.t im_wseventing module documentation) NAME="Ubuntu" VERSION="18.04.5 LTS (Bionic Beaver)" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu 18.04.5 LTS" VERSION_ID="18.04" Below are client details which forwards logs to server above using agentless method OS Name: Microsoft Windows Server 2019 Datacenter OS Version: 10.0.17763 N/A Build 17763 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Server Im getting following error message while trying to forward logs. Seeing this error in eventviewer under eventlog forwarding plugin. I have followed the documentation and generated certs and certs seems to be valid and working. Log Name: Microsoft-Windows-Forwarding/Operational Source: Microsoft-Windows-Forwarding Date: 10/28/2020 2:37:05 AM Event ID: 105 Task Category: None Level: Error Keywords: User: NETWORK SERVICE Computer: computer_name Description: The forwarder is having a problem communicating with subscription manager at address HTTPS://private_ip_address:5986/wsman/. Error code is 2150858819 and Error Message is 鿰柣ƴ. Event Xml: 105 0 2 0 0 0x8000000000000000 438 Microsoft-Windows-Forwarding/Operational computer_name HTTPS://private_ip_address:5986/wsman/ 2150858819 鿰柣ƴ I have tried even port 5985 and it also faces similar error. I have checked whether the server which is the ubuntu is reachable or not, did GET request using postman api tool.POST request seems to not work which might be the cause which might be behind this problem. Below is my nxlog config Module im_wseventing ListenAddr 0.0.0.0 Port 5986 Address https://private_ip_address:5986/wsman HTTPSCertFile %CERTDIR%/server-cert.pem HTTPSCertKeyFile %CERTDIR%/server-key.pem HTTPSCAFile %CERTDIR%/ca-cert.pem * * * * * * Module om_file File "/opt/nxlog/var/log/nxlog/windows_events.log" Path wseventing => file Let me know how do i overcome this issue if possible. Thanks.