Syslog – Send Windows Notification Eventlogs to Linux Syslog Server and Encode to UTF-8

linuxsyslogsyslog-ngwindows

I am trying to setup a windows 2008 server so it's able to send the eventlog messages to an syslog-ng server running linux. I'd prefer something native but I guess it won't be possible.

UPDATE
The first answer recommended to use snare, so far it's the best solution I found, totally painless to setup, and in less than five minutes I've logs to my syslog-ng server.
The only drawaback (not snare fault) was that the logs are sent in windows-1252 charset encoding. So I was not able to tail -f them unless I change the charset somehow.
If you are using syslog-ng this can be easily solved by creating a new source, in my case:

source src_win {
        udp(
                ip("192.168.1.200")
                port(514)
                encoding("WINDOWS-1252"));
};

After this (and assigning the new source to the right place) you will able to see your windows logs properly.

Old content

Looking around I've found a couple of solutions pointed by this page:
http://www.itbuzzer.net/corner/2008/10/how-to-send-windows-events-to-syslog.asp

Does anyone have experience with any of those or something else?

Best Answer

I use Snare.

Snare for Windows is a Windows NT, Windows 2000, Windows XP, and Windows 2003 compatible service that interacts with the underlying Windows Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for Windows also support 64 bit versions of Windows (X64 and IA64).

Snare for Windows Vista is a Windows 2008, Vista and Windows 7 compatible service that interacts with the underlying "Crimson" Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for Windows Vista also support 64 bit versions of Windows (X64).

Snare for Windows and Windows Vista are free software (freeware), released under the terms of the GNU Public Licence (GPL).

Related Topic