Search <book_title>...

InfoScale™ 9.0 Cluster Server Administrator's Guide - Windows

Last Published: 2025-05-23

Product(s): InfoScale & Storage Foundation (9.0)

Platform: Windows

InfoScale log forwarding

Windows Server event logs can be forwarded from a forwarder (source) system to a collector (target) system within the same domain network. You can leverage this Windows Event Forwarding mechanism to forward InfoScale logs from one or more systems to a centralized collector system.

For details on best practices for configuring event log forwarding on Windows Server systems, refer to the Microsoft documentation.

To ensure that WinRM is set up and running on forwarder and collector systems

Verify the status of the Windows Remote Management (WinRM) service by running the following command (use the Run as Administrator option):
winrm quickconfig
- If WinRM is set up and the service is running, the following message is displayed:
```
WinRM service is already running on this machine.
WinRM is already set up for remote management on this computer.
```
- Otherwise, the following message is displayed:
```
WinRM is not set up to receive requests on this machine.
The following changes must be made:

Start the WinRM service.
Set the WinRM service type to delayed auto start.

Make these changes [y/n]?
```
  At the prompt, type y and press Enter.
  For details on configuring WinRM with default settings, refer to the Microsoft documentation.

To ensure that the collector system has access to the forwarder system

On the forwarder system, open the Computer Management window.
- In the left pane, expand System Tools > Local Users and Groups, and click Groups.
- In the right pane, double-click Event Log Readers.
On the Event Log Readers Properties window, on the General tab, click Add.
On the Select Users, Computers, Service Accounts, or Groups dialog box:
- In the Enter the object names to select field, enter the appropriate domain account name, and click Check Names.
  Make sure that the account is validated in the domain network before you proceed.
- Click Object Types.
  On the Object Types dialog box, select the Computers check box, and click OK.
In the Enter the object names to select field, enter the collector system name, and click Check Names.
Make sure that the system is validated in the domain network before you proceed.
Click OK to save the changes and close the dialog box, and then close each of the windows opened for this procedure.

To set up the subscription on the collector system

On the collector system, open the Event Viewer window.
In the left pane, right-click Subscriptions and click Create Subscription.
On the Subscription Properties window:
- In the Subscription name field, provide an appropriate name for the InfoScale event collection subscription from the forwarder systems.
- In the Destination Log dropdown list, select Forwarded Events.
- In the Subscription type and source computers section, select Collector initiated and then click Select Computers.
  In the collector-initiated subscription type, the collector system contacts the specified forwarder systems to collect event details. This subscription type works well in scenarios with a small, manageable number of forwarder systems.
On the Computers dialog box, click Add Domain Computers.
On the Select Computer dialog box, In the Enter the object name to select field, enter the forwarder system name, and click Check Names.
Make sure that the system is validated in the domain network before you proceed.
Repeat steps 4 and 5 for each of the forwarder systems from which you want to collect the InfoScale event details.
For each system in the Computers list on the left, click Test.
Make sure that the Event Viewer dialog box displays the Connectivity test succeeded message.
Click OK to close the dialog boxes.
On the Subscription Properties window, click Select Events.
On the Query Filter window, set the various filters to narrow down the specific list of event details that you want the collector system to collect, and then click OK.
On the Subscription Properties window, click Advanced.
On the Advanced Subscription Settings dialog box:
- Make sure that Machine Account is selected (default).
- Select the Event Delivery Optimization option that is appropriate for the frequency of event details delivery as per your organization's needs.
Click OK to save the changes and close the dialog box, and then close each of the windows opened for this procedure.
Henceforth, events for this subscription begin to appear under Event Viewer > Windows Logs > Forwarded Events, based on the filters set in step 10 and the frequency set in step 12.
(Optional) Alternatively, on the Subscription Properties window, in the Subscription type and source computers section, you can select Source computer initiated and then click Select Computer Groups.
In the source computer-initiated subscription type, the forwarder systems contact the collector system to forward event details. This subscription type works well in scenarios with a large number of forwarder systems.
For details on creating the source computer-initiated subscription type, refer to the Microsoft documentation.