Unstable Event Forwarding from Windows 2003R2 Server

hello,

we having stability problem event forwarding process. after set events being forwarded time, stops. restarting windows remote management service helps, not possible, , service has killed in process explorer.

on source computer event generated, when service stops responding:

event type:  error  event source:  eventforwarder-operational  event category:  none  event id:  102  date:    12.5.2010  time:    10:11:36  user:    n/a  computer:  server  description:  subscription application log can not created. error code 8.  

while on collector computer the subscription runtime status shows errors:

[server.domain] - error - last retry time: 12.5.2010 10:11:36. code (0x8): 
  <f:providerfault provider="event collector plugin windows remote management " 
  path="%systemroot%\system32\wevtfwd.dll" 
  xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault">
  <t:providererror xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/eventlog">windows event forward plugin failed 
  create subscription.
  </t:providererror></f:providerfault> next retry time: 12.5.2010 10:51:36. 

or

 

[server.domain] - error - last retry time: 12.5.2010 10:15:56. code (0x80338126): 
  winrm client cannot complete operation within time specified. check if machine name valid , reachable 
  on network , firewall exception windows remote management service enabled.  next retry time: 12.5.2010 10:55:56. 

 

configuration on source machine

• ws-management 1.1 (kb936059) installed
• collector computer account in local administrators security group
• winrm listening on port 5985

configuration on collector machine - subscription

• collector initiated
• destination log forwarded events
• logging application log
• listening on port 5985
• everything else default

 

there no problem in event forwarding on windows server 2008(r2).

well, somehow have got through this.. 

for reason security log w2k3 server surce computer not collected when using collector machine account. after creating domain account, adding account administrators security group on source computer , assigning subscription on collector computer, works charm..

it bit weird, solved :)

Windows Server  >  Management