I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid destination log".
I'm currently setting up an architecture for centralizing Windows events using the built-in event forwarding and collection capabilities (via WS-management and wecutil).
One of my requirements is to be able to create several subscriptions on the collector machine and to store forwarded events in different log files. For that, I tested creating a custom log (called CustomLog). This log appears in the Event Viewer, under the "Applications and Services Logs" category.
However, I am not able to redirect forwarded events to this CustomLog. CustomLog does not appear in the list of possible destination when creating a subscription in the Event Viewer user interface.
To try what could be wrong, I left it with the default ForwardedEvents as destination and I tried to change it via Powershell. I ran the following command, which is supposed to set the destination log as CustomLog:
wecutil ss "Collect from both sources" /lf:CustomLog
It ran without error. Though, no events are logged into CustomLog, and when I go back to the GUI to create/modify subscriptions and I try to open the subscription I set, I get a pop-up stating the following:
The destination log defined in this subscription cannot be found in the list of valid destination logs on this computer. verify that this log exists on the computer and is valid as a destination for forwarded events. Note that classic logs, analytic and debug logs and the Security log cannot be used as destination.
Does anybody know what a "valid destination log" is and how I could turn my CustomLog into such a valid destination?
Best Answer
The following Microsoft blog details the steps for creating separate log files. In fact, you can create any number of log files. I just completed the steps and can confirm it works on Windows 10.
Creating Custom Windows Event Forwarding Logs
Taking things a step further, I found the following Microsoft blog helpful for setting up a tiered architecture.
DIY Client Monitoring – Setting up Tiered Event Forwarding