List of WEC events

Transcription

Welcome back to your free training course for Windows 7. In this video I will look at source initiated subscriptions for event forwarding. In the last video I looked at collector initiated subscriptions. Collector initiated subscriptions are when the collecting computer asks the forwarding computer for events at regular intervals. This works well in a small environment but does not scale very well in bigger environments. In this video I will look at source initiated events. This is when the forwarding computer contacts the collector computer when it is ready to transfer events. This scales better in larger environments. Since the forwarding computer transfers events as required, transfers can happen at any time. To configure the forwarding computer to transfer events to the collector computer, once again you need to run WinRM QuickConfig if it has not already been run. The computer next needs to know where to send the events. This is configured using group policy. The settings are found in computer configuration, administrative templates, Windows components and event forwarding. There is only one setting that you need to configure, as shown here. It is quite long but it essentially tells the client where to find the server or servers that are collecting events. If you watched our last video on collector initiated events, you will remember having to add the computer account for the collector computer to the local event log readers group. Since the forwarding computer is contacting the collector, the collector does not require access to the local computer and thus this step is not required. I will now change to my Windows 7 computer to look at how to configure the computer to forward events to another computer configured as a collector. In order to configure this computer for event forwarding using source initiated subscriptions, that is, the client will forward events to the collector automatically, I need to open a command prompt with administrator rights. Just like I did in the last video where I configured the forwarding computer to use collector initiated subscription, I need to run WinRM QuickConfig unless it has been run before. Once again I will press Y for both questions to configure the Windows Remote Management service and the Windows Firewall for use with Event Forwarding. Once the configuration is complete I need to run GPEdit.msc from the start menu to edit the local group policy. In an enterprise environment you would create a group policy for the domain so you could configure multiple computers at the same time. To configure the source initiated settings, open computer configuration, Administrative templates, Windows Components and then event forwarding. In this folder select the second option that begins with configure the server address. In the group policy select the option enabled. Next the server settings need to be configured. If you look at the help section at the bottom, the syntax for the server location is shown. It can be a bit precise and complex but if you stick with the defaults it is a lot easier. To configure the subscription settings, press the button show. From here you can enter in multiple subscriptions if needed. This will tell the client where the address of the collector is. All I need to do is enter “server equals” and the address of the collector. You need to enter in the fully qualified domain name so I have added ITFreeTraining.local to the end. You could also use HTTPS if it was configured. In most cases simply putting “server equals” and the fully qualified domain name is enough. If you need to put in additional parameters, refer to help in group policy. That is all you need to do to configure the client or forwarder to use source initiated subscriptions. Next you need to configure the collector. To do this you once again need to run WinRM QuickConfig. Since the client will be communicating with the server, this command needs to run to ensure the service is running and the firewall is configured correctly. Next the command WECUtil with the parameter QC needs to be run. QC stands for quick config. This is the same command that needs to be run to set up collector initiated subscriptions. Lastly you need to configure a subscription on the collector. This basically tells the collector to expect forwarders to contact it with events. You can configure the subscription using the event viewer and also using the command line tool WECUtil. I will change to my Windows Server 2008 R2 computer to show how to configure it to receive forwarded events. First of all open a command prompt and run the command WinRM QuickConfig. Just like on the forwarders, press Y twice to configure the service on the computer and the firewall. The next command that needs to be run on the collector computer is WECUtil QC. This will configure the Windows Event Collector service. This service will process the events sent from the forwarders. Next I will open event viewer from the start menu to configure a subscription for the collector. The process is much the same as the previous video on setting up collector initiated subscriptions. First of all right click on subscriptions and select create subscription. From here enter in a name and description for the subscription. After this is done, select where you want to store the forwarded events. I believe in most cases you should leave it on the default forwarded events so the events are kept separate from the regular events. Below this select the option source computer initiated. This will tell the collector to expect the clients to send events to this computer. Once this is done select the option select computer groups. This will determine which computers will have access to send the collector events. In most cases it is simplest just to add the Domain computers. This will allow any computer in your domain to forward events to the collector. At the bottom you can add any additional certificates if you need them. Once you have finished deciding which computers will have access, go back to the properties and press select events. This will configure which events will be collected. In this case I will select critical and error events and select all the Windows logs. The more events that you select the more traffic that will need to be transferred to the collector from the forwarder. If I select the XML tab, notice the selections I have made in XML format. It is possible to use your own XML file here. In a moment I will look at how you can export the complete subscription and import it again using XML. This is a great option if you want to configure multiple computers the same way. Once the subscription is configured I can exit out and go back to the Event Viewer. Once back in the Event Viewer, all the subscriptions that have been created and the current state of the subscriptions will show under subscriptions. There is a lot of configuration for subscriptions that can be performed from the command line. From the command line, run WECUtil with no parameters to show all the options. The names for the commands are very long; however, Microsoft has helped by created a two letter code for each command making it a lot easier. The first command I will look at is enumerate subscription, which can be shortened to ES. When you run this, it will show all the subscriptions that have been created on this computer. If you want to export the configuration for a subscription, you can use the command get subscription which can be abbreviated to GS. Next enter in the name of the subscription you want to export followed by the parameter /f:XML. This will tell Windows to export the setting in XML format. Lastly you want to store the data in a file so use the greater than sign followed by a filename. This tells Windows to take the output from the WECUtil command and save it to the file given. If I use the command type with the filename to which I just exported the data, you can see the XML subscription file in XML format. Generally it is easier to use the event viewer to create new subscriptions rather than creating an XML file. However, if you want to import an XML file because you want to use the same settings on a different computer, you can use the create subscription option that can be abbreviated to CS followed by the filename. In this case, the command will fail because there is already a subscription on the computer with the same name. That’s it for the command line. When we go back to the event viewer, notice that the subscription has an exclamation mark and came up as inactive. Right clicking the subscription and selecting run time status will give you some information. The error code in this case means that no forwarders on the network have used the collector as yet. I will now pause the video and allow some time to pass. Now you can see the subscription has a green tick and the type has changed to source initiated. Given time the forwarder will transfer events to the collector. If after a while no events have been transferred, check the configuration and make sure it is correct. If no events are coming through check the server location in group policy and also make sure that you have not configured too many filtering options in the subscription preventing any events from being transferred from the forwarder to the collector. This covers event forwarding, collector initiated in the last video and source initiated in this video. In the next video I will look at Data Collector Sets. Data collector Sets allow you to measure performance settings on your computer, helping you to troubleshoot problems. I hope you have enjoyed another free video from IT Free Training.