Welcome back to your free training course for Windows 7. In this video I will look at
source initiated subscriptions for event forwarding. In the last video I looked at collector initiated
subscriptions. Collector initiated subscriptions are when the collecting computer asks the
forwarding computer for events at regular intervals. This works well in a small environment
but does not scale very well in bigger environments.
In this video I will look at source initiated events. This is when the forwarding computer
contacts the collector computer when it is ready to transfer events. This scales better
in larger environments.
Since the forwarding computer transfers events as required, transfers can happen at any time.
To configure the forwarding computer to transfer events to the collector computer, once again
you need to run WinRM QuickConfig if it has not already been run. The computer next needs
to know where to send the events. This is configured using group policy. The settings
are found in computer configuration, administrative templates, Windows components and event forwarding.
There is only one setting that you need to configure, as shown here. It is quite long
but it essentially tells the client where to find the server or servers that are collecting
events.
If you watched our last video on collector initiated events, you will remember having
to add the computer account for the collector computer to the local event log readers group.
Since the forwarding computer is contacting the collector, the collector does not require
access to the local computer and thus this step is not required. I will now change to
my Windows 7 computer to look at how to configure the computer to forward events to another
computer configured as a collector.
In order to configure this computer for event forwarding using source initiated subscriptions,
that is, the client will forward events to the collector automatically, I need to open
a command prompt with administrator rights.
Just like I did in the last video where I configured the forwarding computer to use
collector initiated subscription, I need to run WinRM QuickConfig unless it has been run
before.
Once again I will press Y for both questions to configure the Windows Remote Management
service and the Windows Firewall for use with Event Forwarding.
Once the configuration is complete I need to run GPEdit.msc from the start menu to edit
the local group policy. In an enterprise environment you would create a group policy for the domain
so you could configure multiple computers at the same time.
To configure the source initiated settings, open computer configuration, Administrative
templates, Windows Components and then event forwarding.
In this folder select the second option that begins with configure the server address.
In the group policy select the option enabled. Next the server settings need to be configured.
If you look at the help section at the bottom, the syntax for the server location is shown.
It can be a bit precise and complex but if you stick with the defaults it is a lot easier.
To configure the subscription settings, press the button show. From here you can enter in
multiple subscriptions if needed. This will tell the client where the address of the collector
is. All I need to do is enter “server equals” and the address of the collector. You need
to enter in the fully qualified domain name so I have added ITFreeTraining.local to the
end. You could also use HTTPS if it was configured. In most cases simply putting “server equals”
and the fully qualified domain name is enough. If you need to put in additional parameters,
refer to help in group policy.
That is all you need to do to configure the client or forwarder to use source initiated
subscriptions. Next you need to configure the collector. To do this you once again need
to run WinRM QuickConfig. Since the client will be communicating with the server, this
command needs to run to ensure the service is running and the firewall is configured
correctly.
Next the command WECUtil with the parameter QC needs to be run. QC stands for quick config.
This is the same command that needs to be run to set up collector initiated subscriptions.
Lastly you need to configure a subscription on the collector. This basically tells the
collector to expect forwarders to contact it with events. You can configure the subscription
using the event viewer and also using the command line tool WECUtil. I will change to
my Windows Server 2008 R2 computer to show how to configure it to receive forwarded events.
First of all open a command prompt and run the command WinRM QuickConfig. Just like on
the forwarders, press Y twice to configure the service on the computer and the firewall.
The next command that needs to be run on the collector computer is WECUtil QC. This will
configure the Windows Event Collector service. This service will process the events sent
from the forwarders.
Next I will open event viewer from the start menu to configure a subscription for the collector.
The process is much the same as the previous video on setting up collector initiated subscriptions.
First of all right click on subscriptions and select create subscription. From here
enter in a name and description for the subscription. After this is done, select where you want
to store the forwarded events. I believe in most cases you should leave it on the default
forwarded events so the events are kept separate from the regular events.
Below this select the option source computer initiated. This will tell the collector to
expect the clients to send events to this computer. Once this is done select the option
select computer groups.
This will determine which computers will have access to send the collector events. In most
cases it is simplest just to add the Domain computers. This will allow any computer in
your domain to forward events to the collector.
At the bottom you can add any additional certificates if you need them. Once you have finished deciding
which computers will have access, go back to the properties and press select events.
This will configure which events will be collected.
In this case I will select critical and error events and select all the Windows logs. The
more events that you select the more traffic that will need to be transferred to the collector
from the forwarder.
If I select the XML tab, notice the selections I have made in XML format. It is possible
to use your own XML file here. In a moment I will look at how you can export the complete
subscription and import it again using XML. This is a great option if you want to configure
multiple computers the same way.
Once the subscription is configured I can exit out and go back to the Event Viewer.
Once back in the Event Viewer, all the subscriptions that have been created and the current state
of the subscriptions will show under subscriptions.
There is a lot of configuration for subscriptions that can be performed from the command line.
From the command line, run WECUtil with no parameters to show all the options.
The names for the commands are very long; however, Microsoft has helped by created a
two letter code for each command making it a lot easier.
The first command I will look at is enumerate subscription, which can be shortened to ES.
When you run this, it will show all the subscriptions that have been created on this computer.
If you want to export the configuration for a subscription, you can use the command get
subscription which can be abbreviated to GS. Next enter in the name of the subscription
you want to export followed by the parameter /f:XML. This will tell Windows
to export the setting in XML format. Lastly you want to store the data in a file so use
the greater than sign followed by a filename. This tells Windows to take the output from
the WECUtil command and save it to the file given.
If I use the command type with the filename to which I just exported the data, you can
see the XML subscription file in XML format.
Generally it is easier to use the event viewer to create new subscriptions rather than creating
an XML file. However, if you want to import an XML file because you want to use the same
settings on a different computer, you can use the create subscription option that can
be abbreviated to CS followed by the filename. In this case, the command will fail because
there is already a subscription on the computer with the same name.
That’s it for the command line. When we go back to the event viewer, notice that the
subscription has an exclamation mark and came up as inactive. Right clicking the subscription
and selecting run time status will give you some information. The error code in this case
means that no forwarders on the network have used the collector as yet. I will now pause
the video and allow some time to pass.
Now you can see the subscription has a green tick and the type has changed to source initiated.
Given time the forwarder will transfer events to the collector. If after a while no events
have been transferred, check the configuration and make sure it is correct. If no events
are coming through check the server location in group policy and also make sure that you
have not configured too many filtering options in the subscription preventing any events
from being transferred from the forwarder to the collector.
This covers event forwarding, collector initiated in the last video and source initiated in
this video. In the next video I will look at Data Collector Sets. Data collector Sets
allow you to measure performance settings on your computer, helping you to troubleshoot
problems. I hope you have enjoyed another free video from IT Free Training.