mukkumayc / am-cp-log-analyzer Goto Github PK

Currently we failed to run WEF on security logs, getting "The forwarder is having a problem communicating with subscription manager error code 5" error.
For now we found out 3 completely unrelated solutions, which denotes there might be a lot of reasons for this error:

1. "This one was caused by a system level proxy setting. Removing this setting fixed the error.
   Use this command to see if there is a system level proxy
   Netsh winhttp show proxy" - simply not our case (http://zenshaze.com/wp/?p=57).
2. "For my situation, this ended up being the problem. This path was too much
   Changed this:
   Server=http://fqdnofsubscriptionserver:5985/wsman/SubscriptionManager/WEC,Refresh=60
   To this: Server=fqdnofsubscriptionserver
   Events started rolling in." - it's just weird, but anyway it did not work out (https://www.reddit.com/r/sysadmin/comments/6ag0q0/source_initiated_event_forwarding_access_is_denied/)
3. "I had a terrible experience on my first run which I spent days trying to resolve it.
   If you can recall that network service is used from client to communicate to server, well, network service will act as computer object over the network. so from server point of view, this is request from Client computer account. My server somehow get default setting in security to block all computer account access. By default, there should be a group called “Everyone”. but it’s missing. After I added authenticated users group into this security, everything works." - we did not understand the proposed solution (https://geeksilver.wordpress.com/2016/01/15/create-eventlog-forwarding-and-winrm/)

There are also 2 threads on microsoft forums with our problem

https://social.technet.microsoft.com/Forums/lync/en-US/9c995451-2eaa-47ff-a242-6363fe63f8eb/source-initiated-event-forwarding-access-denied-errors-on-source-computers?forum=winserverManagement
https://social.technet.microsoft.com/Forums/office/en-US/479a92c9-2119-4ced-b3df-c1ce9233272c/troubleshooting-event-forwarding-issue?forum=winserverManagement

One is empty, another is ended "OK pretty much at wits end here, starting to suspect a bug in Server 2012"

• Изучить механизмы логирования в Windows
• Сделать сбор логов при помощи ELK Stack для одной машины
• Создать и настроить несколько виртуальных машин
• Сделать сбор логов для нескольких машин