Forward Windows system Event logs to a Linux Syslog Server with no agent

• We have a SCOM 2012 server.

• We have SNARE agents for PCI compliance, but now we want to save money by gathering all events for all Windows servers using its native features.

• We also have a centralized Linux server running SYSLOG that will aggregate the logs to our log retention appliance (this is all for PCI purposes)

Thus, my question:

Can a windows server (SCOM 2012) forwards the events logs to a Linux syslog server? I assume this would occur by following a standard flat file format or something similar.

Thanks

Solution 1:

You need to use a Syslog agent, as Windows doesn't provide one.

...the Windows OS doesn’t include a syslog agent that is capable of sending syslog data to a syslog server. Without a syslog agent, not only can’t the Windows OS send syslog messages to a syslog server but it also can’t send syslog messages from any applications running in the Windows OS (like a web server or database).

Source

Both that source page, and Googling for "Windows Syslog Agent" provide many different Syslog agents you can try.