E
EugenBerend
Hi
We've suddenly discovered that one of our Event Forwarders has stopped to forward events to a collector. (the others working fine)
There is no errors in Event Log on the forwarder side but there are messages like:
The subscription "subscription name" is created successfully.
and then:
The subscription "subscription name" is unsubscribed.
What I was doing:
1) restarted winrm services on both forwarder and collector;
2) verified 5985 connection;
3) verified that this forwarder is added to group which is configured as Source computer group
4) verified that Network Service has access to logs (this is domain controller, the permission to read was delegated to duiltin\administrators group, and, as I can see, the "network service" account is a member of this group.
What I have to check too?
Very appreciated for any help
Continue reading...
We've suddenly discovered that one of our Event Forwarders has stopped to forward events to a collector. (the others working fine)
There is no errors in Event Log on the forwarder side but there are messages like:
The subscription "subscription name" is created successfully.
and then:
The subscription "subscription name" is unsubscribed.
What I was doing:
1) restarted winrm services on both forwarder and collector;
2) verified 5985 connection;
3) verified that this forwarder is added to group which is configured as Source computer group
4) verified that Network Service has access to logs (this is domain controller, the permission to read was delegated to duiltin\administrators group, and, as I can see, the "network service" account is a member of this group.
What I have to check too?
Very appreciated for any help
Continue reading...