3
responses

HI all, I am trying to transfer Windows eventlog (Securty, Application and System) from a server A to a server B. It is almost working if I send all the events of server A in a flat file on server B.
But my goal is a little bit different : I need to have the serverA-Events loggued in the eventviewer of the server B.
Do yo know if it is possible to achieve this ?
Thanks in advance !

AskedJune 6, 2016 - 1:14pm

Answer (1)

You can do this the Microsoft way configuring one computer to forward and another to collect events.

It has nothing to do with NXLog

Comments (2)

  • sophie's picture

    Thanks for your comment ! By the way, is it possible to transfer the evtx file in same format that it was on source server ?
    I asked this because on my destination server, the format of target file is different than the source evtx one.
    Thanks in advance !

  • adm's picture
    (NXLog)

    When using Windows Event Forwarding the source machine will forward in an XML based format record-by-record and the collector computer will store that in the native binary evtx format. If you want to transfer evtx without any modifications you should copy it directly, use rsync or put it on a file share.