Syslog-ng WEC (WEC) logging facilities are configured in the wec.yaml file located by default at /opt/syslog-ng/etc/wec.yaml.
- If you are using a systemd platform and start WEC using systemctl, then stderr is redirected to systemd-journal.
- You can also optionally specify a file to send logs to (in parallel with stderr), that is recommended to ease troubleshooting.
- Debug logging may produce loads of messages, use it only for troubleshooting.
1. Set log 'level' to 'debug' and optionally add a log file.
file: "/opt/syslog-ng/var/wec.log" # optional
2. Restart WEC for taking place the change.
systemctl restart syslog-ng-wec
Development debug logging
- This feature provides additional information about WEC for developers.
- Use it only if One Identity Support asks because of an ongoing service request.
- WEC places the subscription file of every client under /opt/syslog-ng/var/wecstate directory. The filename is the Windows hostname of the client.
- Example: /opt/syslog-ng/var/wecstate/trainingdc.training.local
- Subscriptions are written to disk periodically from the memory. It can be forced by restarting WEC.
- A client subscription can be reset by removing the file.
- Debug logs contain information about subscriptions.
- Windows Event forwarding is managed by the services Windows Remote Management and Windows Event Log.
- Check service events in Event Viewer:
Applications and Services Logs\Microsoft\Windows\Eventlog-ForwardingPlugin
Applications and Services Logs\Microsoft\Windows\Windows Remote Management
- Apply Group Policy changes in a Windows domain with 'gpupdate /force'.
- Generate test events
eventcreate /T ERROR /ID 11 /L APPLICATION /D "This is an application error!"
eventcreate /T WARNING /ID 12 /L SYSTEM /D "This is just a warning in the system log"