A single Windows Event Collector (WEC) server has three documented scaling limits: disk write speed, concurrent WinRM connections, and registry growth from per-client bookmark data. Microsoft’s current guidance is to plan for roughly 3,000 events per second on average across all subscriptions on commodity hardware. The "10k × 10k" rule of thumb (up to 10,000 clients and 10,000 EPS per collector) still circulates widely. IBM QRadar and Juniper JSA documentation still quote it, both attributing it to Microsoft’s article.

Windows records scheduled task activity in two separate event logs. The Security log holds event IDs 4698-4702, covering task creation, deletion, turning on, turning off, and updates, with the full task definition XML attached. The Microsoft-Windows-TaskScheduler/Operational log holds event IDs 106, 140, and 141 for registration changes, plus 100, 200, and 201 for execution. Windows doesn’t switch on either source by default: Microsoft’s own Tarrask analysis states that "neither of these are audited by default and must be explicitly turned on by an administrator.

We are happy to announce the latest release of NXLog Platform, version 1.14. This update adds an entitlements usage summary to the NXLog Platform UI and extends NXLog Agent support to the newest Ubuntu 26.04 LTS release and Red Hat Enterprise Linux 5 for long-lived legacy deployments. Read on for more details about these updates. See data source entitlements and usage at a glance NXLog Platform 1.14 adds entitlements usage visibility to the NXLog Platform UI, giving you a clear breakdown of how your data source license is used without contacting support.

Some of the most critical systems in your infrastructure are also the oldest. If you operate in energy, manufacturing, or government, chances are you have hosts still running Red Hat Enterprise Linux 5 or CentOS 5. Not because anyone forgot to upgrade them, but because upgrading them is not an option. The OS is frozen by compliance requirements, tied to certified industrial equipment, or locked to software that would break on anything newer.

You can centralize logs from firewalls, switches, and Linux hosts with a free syslog server - rsyslog, syslog-ng OSE, and the free plan of NXLog Platform all do the job. The real differences show up in Windows support, secure transport, viewers, and what happens when your environment grows. A firewall, a switch, or an auditor says "send your logs somewhere," and there’s no budget line for it. A free syslog server solves the immediate problem in an afternoon.

Your firewalls already record allowed and denied connections and policy changes. Each vendor logs them in its own format. This post shows you how to get those records into one searchable structure, with working configurations for the most common sources. A firewall log analyzer is a tool that collects logs from firewalls, parses each vendor’s log format into structured fields, and stores the results in one place for searching, alerting, and reporting.