Collect logs from Windows Event Forwarding

Windows Event Forwarding (WEF) sends logs from Windows Event Log to a remote server without needing an agent on each host. This approach reduces the administrative effort required to deploy and manage third-party software. However, WEF has several limitations, including no support for log parsing or filtering, and the inability to collect logs from ETW providers. Despite these limitations, WEF remains a practical choice when agent installation is not possible.

NXLog Agent can collect logs forwarded by Windows Event Forwarding in two ways. Use the Windows Event Collector input module to act as a WEC, or use the Event Log for Windows input module to collect forwarded events from a Windows server configured as a WEC.

About Windows Event Forwarding

A WEF setup consists of two components. The Windows Event Collector (WEC), or Subscription Manager, is the server that receives events. The WEF client is the system that generates the events. The connection between them, called a subscription, can be one of the following:

Push, or source-initiated subscription, where WEF clients are configured to forward their logs to the WEC using a Group Policy Object (GPO). This is the most flexible and scalable method because it allows you to collect logs from different sources without managing a list of client machines.
Pull, or collector-initiated, where the WEC is configured with a list of hosts from which to collect logs. This is useful when you only need to monitor a small number of hosts.

Figure 1. Components of a Windows Event Forwarding setup

Configure NXLog Agent as a Windows Event Collector

NXLog Agent can assume the role of a WEC by configuring the Windows Event Collector input module to receive logs from WEF clients using the push method. This allows you to configure your WEC on any supported platform, including Linux systems, eliminating the Windows-only requirement.

Authentication between the WEC and WEF clients requires either Kerberos or HTTPS. Since NXLog Agent supports both, deciding which one to use depends on your environment.

Windows Event Forwarding with Kerberos authentication

You can use Kerberos authentication when you install NXLog Agent on a host in an Active Directory (AD) environment. In this setup, configure a Kerberos client that can authenticate with AD on the host where NXLog Agent is installed. Configure WEF clients joined to the domain to forward their events to NXLog Agent using a GPO.

Figure 2. NXLog Agent as a Windows Event Collector using Kerberos authentication

For a step-by-step guide on configuring NXLog Agent with Kerberos, see Using Kerberos authentication in the NXLog Agent Reference Manual.

Windows Event Forwarding with certificate-based authentication (HTTPS)

Certificate-based authentication is ideal for collecting logs from Windows servers that are not part of an Active Directory domain. This method requires X.509 certificates for the WEC and WEF clients. You must also configure Windows Remote Management and event forwarding on each client. You can do this manually or automate it using a script, such as the one available in our public git repository.

Figure 3. NXLog Agent as a Windows Event Collector using HTTPS

For a step-by-step guide on configuring NXLog Agent with certificate-based authentication, see Using HTTPS certificate-based authentication in the NXLog Agent Reference Manual.

Configure NXLog Agent

The example below demonstrates how to configure NXLog Agent as a WEC when using Kerberos authentication. For more configuration examples, see the Windows Event Collector input module documentation.

Example 1. Receiving WEF logs with NXLog Agent

This configuration specifies two QueryXML directives: one for WEF client hostnames that start with filesrv and another for all other clients. Both queries collect the same base logs, but the first collects additional file system auditing events.

The list of base events being collected is inspired by Microsoft’s recommendation for using Windows Event Forwarding to help with intrusion detection.

nxlog.conf

<Input wec_server>
    Module        im_wseventing
    Address       http://<nxlog_host_name>:5985/wsman
    ListenAddr    0.0.0.0
    Port          5985

    # Subscription event query for file servers
    <QueryXML>
        <!-- The computer value is case-sensitive -->
        <Computer>filesrv*</Computer>
        <QueryList>
            <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
                <!-- 106: Task scheduler Task Registered -->
                <!-- 141: Task Registration Deleted -->
                <!-- 142: Task Deleted -->
                <Select Path="Microsoft-Windows-TaskScheduler/Operational">*[
                System[Provider[@Name='Microsoft-Windows-TaskScheduler'] and
                (EventID=106 or EventID=141 or EventID=142 )]]</Select>
                <Select Path="System">*[System[Provider[
                @Name='Microsoft-Windows-TaskScheduler'] and (EventID=106 or
                EventID=141 or EventID=142 )]]</Select>
            </Query>
            <Query Id="1" Path="System">
                <!-- 12: The operating system started -->
                <!-- 13: The operating system is shutting down -->
                <!-- 4608: Windows is starting up -->
                <Select Path="System">*[System[Provider[
                @Name='Microsoft-Windows-Kernel-General'] and
                (EventID=12 or EventID=13)]]</Select>
                <Select Path="Security">*[System[(EventID=4608)]]</Select>
            </Query>
            <Query Id="2" Path="System">
                <!-- 7000: Service Install -->
                <!-- 7045: Service start failure -->
                <!-- 4697: New service -->
                <Select Path="System">*[System[Provider[
                @Name='Service Control Manager'] and (EventID = 7000 or
                EventID=7045)]]</Select>
                <Select Path="Security">*[System[(EventID=4697)]]</Select>
            </Query>
            <Query Id="3" Path="Security">
               <!-- 4616: System time change  -->
               <Select Path="Security">*[System[(EventID=4616)]]</Select>
            </Query>
            <Query Id="4" Path="System">
                <!-- Event log service events -->
                <Select Path="System">*[System[Provider[
                @Name='Microsoft-Windows-Eventlog']]]</Select>
            </Query>
            <Query Id="5" Path="Security">
                <!-- Event log service events specific to Security channel -->
                <Select Path="Security">*[System[Provider[
                @Name='Microsoft-Windows-Eventlog']]]</Select>
            </Query>
            <Query Id="6" Path="Security">
                <!-- 1102: Security Log cleared events -->
                <!-- 1100: EventLog Service shutdown -->
                <Select Path="Security">*[System[(EventID=1102 or
                EventID = 1100)]]</Select>
            </Query>
            <Query Id="7" Path="System">
                <!-- 104: Other Log cleared events -->
                <Select Path="System">*[System[(EventID=104)]]</Select>
            </Query>
            <Query Id="8" Path="Security">
                <!-- Local logons without network or service events -->
                <Select Path="Security">*[System[(EventID=4624)]] and
                (*[EventData[Data[@Name="LogonType"]!="3"]]) and
                (*[EventData[Data[@Name="LogonType"]!="5"]])</Select>
            </Query>
            <Query Id="9" Path="Security">
                <!-- 4647: User initiated logoff -->
                <Select Path="Security">*[System[(EventID=4647)]]</Select>
            </Query>
            <Query Id="10" Path="Security">
                <!-- 4625: An account failed to Log on -->
                <Select Path="Security">*[System[(EventID=4625)]] and
                (*[EventData[Data[@Name="LogonType"]!="2"]]) </Select>
            </Query>
            <Query Id="11" Path="Application">
                <!-- WER events for application crashes only -->
                <Select Path="Application">*[System[Provider[
                @Name='Windows Error Reporting']]] and
                (*[EventData[Data[3] ="APPCRASH"]])</Select>
            </Query>
            <Query Id="12" Path="Security">
                <!-- 4624: Service logon events if the user account
                     isn't LocalSystem, NetworkService, LocalService -->
                <Select Path="Security">*[System[(EventID=4624)]] and
                (*[EventData[Data[@Name="LogonType"]="5"]]) and
                (*[EventData[Data[@Name="TargetUserSid"] != "S-1-5-18"]]) and
                (*[EventData[Data[@Name="TargetUserSid"] != "S-1-5-19"]]) and
                (*[EventData[Data[@Name="TargetUserSid"] != "S-1-5-20"]])</Select>
            </Query>
            <Query Id="13" Path="Security">
                <!-- 4720: New user account created -->
                <!-- 4722: User account enabled -->
                <!-- 4725: User account disabled -->
                <!-- 4726: User account deleted -->
                <Select Path="Security">*[System[(EventID=4720 or EventID=4722
                or EventID=4725 or EventID=4726)]]</Select>
            </Query>
            <Query Id="14" Path="Security">
                <!-- Network share object access without IPC$ and
                     Netlogon shares -->
                <Select Path="Security">*[System[(EventID=5140)]] and
                (*[EventData[Data[@Name="ShareName"]!="\\*\IPC$"]]) and
                (*[EventData[Data[@Name="ShareName"]!="\\*\NetLogon"]])</Select>
            </Query>
            <Query Id="15" Path="Security">
                <!-- 5142: Network share created -->
                <!-- 5144: Network share deleted -->
                <Select Path="Security">*[System[(EventID=5142 or
                EventID=5144)]]</Select>
            </Query>
            <Query Id="16" Path="Security">
                <!-- 4715: The audit policy (SACL) on an object was changed. -->
                <!-- 4817: Auditing settings on object were changed. -->
                <!-- 4656: A handle to an object was requested. -->
                <!-- 4658: The handle to an object was closed. -->
                <!-- 4660: An object was deleted. -->
                <!-- 4663: An attempt was made to access an object. -->
                <!-- 4664: An attempt was made to create a hard link. -->
                <!-- 4670: Permissions on an object were changed. -->
                <Select Path="Security">*[System[(EventID=4715 or EventID=4817
                or EventID=4656 or EventID=4658 or EventID=4660 or EventID=4663
                or EventID=4670)]]</Select>
            </Query>
        </QueryList>
    </QueryXML>

    # Subscription event query for all other servers
    <QueryXML>
        <QueryList>
            <Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational">
                <!-- 106: Task scheduler Task Registered -->
                <!-- 141: Task Registration Deleted -->
                <!-- 142: Task Deleted -->
                <Select Path="Microsoft-Windows-TaskScheduler/Operational">*[
                System[Provider[@Name='Microsoft-Windows-TaskScheduler'] and
                (EventID=106 or EventID=141 or EventID=142 )]]</Select>
                <Select Path="System">*[System[Provider[
                @Name='Microsoft-Windows-TaskScheduler'] and (EventID=106 or
                EventID=141 or EventID=142 )]]</Select>
            </Query>
            <Query Id="1" Path="System">
                <!-- 12: The operating system started -->
                <!-- 13: The operating system is shutting down -->
                <!-- 4608: Windows is starting up -->
                <Select Path="System">*[System[Provider[
                @Name='Microsoft-Windows-Kernel-General'] and
                (EventID=12 or EventID=13)]]</Select>
                <Select Path="Security">*[System[(EventID=4608)]]</Select>
            </Query>
            <Query Id="2" Path="System">
                <!-- 7000: Service Install -->
                <!-- 7045: Service start failure -->
                <!-- 4697: New service -->
                <Select Path="System">*[System[Provider[
                @Name='Service Control Manager'] and (EventID = 7000 or
                EventID=7045)]]</Select>
                <Select Path="Security">*[System[(EventID=4697)]]</Select>
            </Query>
            <Query Id="3" Path="Security">
               <!-- 4616: System time change  -->
               <Select Path="Security">*[System[(EventID=4616)]]</Select>
            </Query>
            <Query Id="4" Path="System">
                <!-- Event log service events -->
                <Select Path="System">*[System[Provider[
                @Name='Microsoft-Windows-Eventlog']]]</Select>
            </Query>
            <Query Id="5" Path="Security">
                <!-- Event log service events specific to Security channel -->
                <Select Path="Security">*[System[Provider[
                @Name='Microsoft-Windows-Eventlog']]]</Select>
            </Query>
            <Query Id="6" Path="Security">
                <!-- 1102: Security Log cleared events -->
                <!-- 1100: EventLog Service shutdown -->
                <Select Path="Security">*[System[(EventID=1102 or
                EventID = 1100)]]</Select>
            </Query>
            <Query Id="7" Path="System">
                <!-- 104: Other Log cleared events -->
                <Select Path="System">*[System[(EventID=104)]]</Select>
            </Query>
            <Query Id="8" Path="Security">
                <!-- Local logons without network or service events -->
                <Select Path="Security">*[System[(EventID=4624)]] and
                (*[EventData[Data[@Name="LogonType"]!="3"]]) and
                (*[EventData[Data[@Name="LogonType"]!="5"]])</Select>
            </Query>
            <Query Id="9" Path="Security">
                <!-- 4647: User initiated logoff -->
                <Select Path="Security">*[System[(EventID=4647)]]</Select>
            </Query>
            <Query Id="10" Path="Security">
                <!-- 4625: An account failed to Log on -->
                <Select Path="Security">*[System[(EventID=4625)]] and
                (*[EventData[Data[@Name="LogonType"]!="2"]]) </Select>
            </Query>
            <Query Id="11" Path="Application">
                <!-- WER events for application crashes only -->
                <Select Path="Application">*[System[Provider[
                @Name='Windows Error Reporting']]] and
                (*[EventData[Data[3] ="APPCRASH"]])</Select>
            </Query>
            <Query Id="12" Path="Security">
                <!-- 4624: Service logon events if the user account
                     isn't LocalSystem, NetworkService, LocalService -->
                <Select Path="Security">*[System[(EventID=4624)]] and
                (*[EventData[Data[@Name="LogonType"]="5"]]) and
                (*[EventData[Data[@Name="TargetUserSid"] != "S-1-5-18"]]) and
                (*[EventData[Data[@Name="TargetUserSid"] != "S-1-5-19"]]) and
                (*[EventData[Data[@Name="TargetUserSid"] != "S-1-5-20"]])</Select>
            </Query>
            <Query Id="13" Path="Security">
                <!-- 4720: New user account created -->
                <!-- 4722: User account enabled -->
                <!-- 4725: User account disabled -->
                <!-- 4726: User account deleted -->
                <Select Path="Security">*[System[(EventID=4720 or EventID=4722
                or EventID=4725 or EventID=4726)]]</Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

Configure NXLog Agent to collect from a Windows Event Collector

NXLog Agent can collect events from a native Windows Event Collector using the Event Log for Windows input module. To do this, configure a Windows server as the collector and configure WEF clients to forward their events to that server, as described in the following steps.

Prerequisites

Communication between WEF clients and the collector is done over WinRM. Ensure the Windows Remote Management (WS-Management) service is running and configured to start automatically on the collector.
WEF uses the Network Service account to send events to the collector. This account cannot access the Security event log or other custom logs by default. To grant it access, add the Network Service account to the Event Log Readers group on WEF clients or through Group Policy. See Forwarding events from the Security log for more information.

Configure the subscription manager

On the Windows server that will act as the event collector, open Event Viewer (eventvwr.msc).
Right-click Subscriptions and then Create Subscription….
If the Windows Event Collector service is not running, Windows prompts you to start it. Click Yes.
Enter a subscription name and description.
For Destination log, select Forwarded Events.
Choose the subscription type you would like to configure, either Collector initiated or Source computer initiated, then click on the respective button to select the hosts that this subscription applies to.
Click on the Select Events… button and choose the events to collect. You can filter by log type or source, and by a list of event IDs to include or exclude.
Click the OK button to close the Query Filter dialog.
Click on the Advanced… button.
For Event Delivery Optimization, select Minimize Latency to ensure the collector receives events as soon as possible.
For Protocol, select HTTP to use Kerberos authentication or HTTPS to use certificate-based authentication.
If you chose Collector initiated for the subscription type, you must also specify the user account to use to collect events from the remote hosts.

Configure WEF clients

If you created a Source computer initiated subscription, you must configure WEF clients to forward their logs to the collector. This is usually done through a domain Group Policy Object (GPO) on a server with the Group Policy Management feature installed:

Open Server Manager and go to Tools > Group Policy Management.
From the Group Policy Management MMC, expand Forest:[name] > Domains and select your domain name.
Right-click on the relevant group policy and select Edit….
Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Event Forwarding.
Open and activate the Configure target Subscription Manager setting.
Click Show… beside the Subscription Managers option.
Add subscription manager settings in the following format:
```
Server=http://<wec_fqdn>:5985/wsman/SubscriptionManager/WEC,Refresh=<interval_in_seconds>
```
The main Subscription Manager properties window contains a Help pane that describes the syntax for this setting, including the required format for HTTPS.
Click OK and Apply to save the policy settings.

Configure NXLog Agent

The example below demonstrates how to configure NXLog Agent to collect logs from a native Windows Event Collector.

Example 2. Collecting WEF logs

This configuration uses the Event Log for Windows input module to collect all events from the dedicated Forwarded Events log. This log is commonly used as the destination for forwarded logs but can be changed according to the destination configured in the subscription.

nxlog.conf

<Input windows_events>
    Module    im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id="0" Path="ForwardedEvents">
                <Select Path="ForwardedEvents">*</Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

Disclaimer

While we endeavor to keep the information in our guides up to date and correct, NXLog makes no representations or warranties of any kind, express or implied about the completeness, accuracy, reliability, suitability, or availability of the content represented here. We update our screenshots and instructions on a best-effort basis.

NXLog does not guarantee that any scripts provided in our guides are error-free, secure, or suitable for any specific environment. Use of the scripts is at your own risk. In no event shall NXLog be liable for any damages or losses arising from using these scripts.

The accurateness of the content was tested and proved to be working in our lab environment at the time of the last revision with the following software versions:

Microsoft Windows Server 2022 Standard
Ubuntu 22.04.5 LTS
NXLog Agent version 6.14.10786

Last revision: 21 July 2026