Return
-
Title
Microsoft Windows events not being filtered by Windows Syslog-ng Agent -
Description
The Windows Syslog-ng Agent is not filtering Microsoft Windows events when the Windows Syslog-ng Agent has been configured to filter Microsoft Windows events. All events sourced from Microsoft Windows are either being blocked or allowed. -
Cause
The "Source Name" within the "Sources and Event ids Properties", and/or "Sources" has an incorrect source named and thus the filter fails when querying Microsoft Windows events.
-
Resolution
The "Source Name" must be defined as "Microsoft-Windows-Events" without the quotation marks as this is the Microsoft Windows name which can be correctly queried.
The "Source Name" is found within the "Sources and Event ids Properties", and/or "Sources", which are both found within the destination's "Event Filters".
For application configuration or implementation advice we recommend our Professional Services Organization. For information on how to contact them please visit https://support.oneidentity.com//professional-services-product-select