Configure Log Forwarder settings
The Event Log Forwarder for Windows Subscriptions and Syslog Server settings are stored in the LogForwarderSettings.cfg
configuration file, located in the product installation directory: \Program Files (x86)\SolarWinds\SolarWinds Event Log Forwarder for Windows
. The configuration file uses XML markup language.
You can make changes to Subscription or Syslog Server settings from this configuration file, or from the Log Forwarder user interface. When a change is saved within the user interface, the configuration file is updated and the Service re-initializes to pick up the changes immediately.
EventLogSubscriptions
Edit the details of an event log subscription used by Log Forwarder. Each subscription is contained under an individual <EventLogSubscription>
element. You can configure the event type, event sources, event IDs, tasks, and so on, for specific subscriptions.
Element | Description |
---|---|
<channels> |
<channels> <string>Application</string> <string>Microsoft-Windows-Application Server-Applications/Admin</string> </channels> |
<types> |
<types> <int>1</int> <int>2</int> </types> |
<sources> |
|
<eventIDs> |
|
<categories> |
|
<keywords> |
|
<users> |
|
<computers> |
|
<facility> |
<facility>0</facility> |
<enabled> |
<enabled>true</enabled> |
<name> |
<name>New Event Log Subscription</name> |
<HidePreview> |
<HidePreview>0</HidePreview> |
SyslogServers
Edit the details of a syslog server used by Log Forwarder. Each syslog server is contained under an individual <SyslogServer>
element. You can configure the server name, IP address, port, and so on, for specific syslog servers.
Element | Description |
---|---|
<enabled> |
<enabled>true</enabled> |
<SendMode> |
<SendMode>0</SendMode> |
<SourceFormat> |
<SourceFormat>0</SourceFormat> |