Return
-
Title
How To Find Event Source Name of Windows Logs (Events) -
Description
The correct Event Source Name is required for creating a filter within the Syslog-ng Agent for Windows. -
Resolution
When creating the filter the correct source name will be the Provider Name in the Event Properties > Details of the log in the Windows Event Viewer when viewing the properties of the log.
When right-clicking on one of the logs (event within Windows Event Viewer) and go to properties, and then navigate to the Details tab the Provider Name can be found either by dropping down the System options in the Friendly View or by switching to the XML View and looking for.
Below is an example where the Provider Name is shown within the XML view.
In the above example the source name for the filter within the Windows Agent would be:
Microsoft-Windows-RestartManager