PlaybookGet Windows event logs into a syslog server
safe intermediate #windows#event log#nxlog#wef#agent#winlogbeat
When to use this: Windows servers or PCs need to appear in the central log store, but Windows does not speak syslog natively.
Windows has its own event log and no built-in syslog sender. There are three common approaches:
| Approach | How it works | Good for |
|---|---|---|
| Agent that forwards as syslog (for example NXLog Community Edition) | A service reads Event Log channels and sends them to your syslog server, usually as JSON or syslog text | Keeping one syslog server for everything |
| Platform agent (for example the agent or sidecar of Graylog, or Wazuh’s agent) | The agent sends to its own platform in a richer format | Search and security analytics |
| Windows Event Forwarding (WEF) | Windows machines push events to a Windows collector with built-in tools | Domain environments without third-party agents |
Steps in outline
- Decide the destination (plain syslog server, or a log platform).
- Install the agent on one test machine and select channels (Security, System, Application).
- Point it at the server’s IP and port, using TCP where possible.
- Check the events on the server, then roll out through your deployment tool.
- Filter noisy event IDs and watch the volume (see the sizing scenario).
Use the vendor’s current documentation for the agent’s configuration syntax: agent configs change between versions.
How to verify it worked
- Windows security events (logons, service changes) appear on the central server with the right host name and time.
Common errors and fixes
Expecting
eventvwr to have a 'send to syslog' option It does not. You need an agent or a forwarding mechanism as described above. Events arrive as one unreadable line Choose an agent format that preserves fields (JSON or structured data) and parse them in your log platform.
Q&A
How do I send Windows Event Logs to syslog?
Install an agent that reads the event log and forwards it (NXLog Community Edition, or the agent of your log platform), or use Windows Event Forwarding to a collector.
Do I need to send every Windows event?
No. Start with Security, System and key Application channels, and filter noisy event IDs to control volume.