I am trying to monitor the Active Directory Server for logs. I have a universal forwarder installed on a Windows AD Server, and there are logs at the following path:
%SystemRoot%\System32\Winevt\Logs\
How can I monitor it? I have tried the following, but it does not work:
[monitor://%SystemRoot%/System32\Winevt\Logs]
targetDC = hqdc06
baseline = false
disabled = 0
index = wineventlog
renderXml=false
Sourcetype = Active Directory
↧