{"id":198,"date":"2023-06-01T23:42:11","date_gmt":"2023-06-02T03:42:11","guid":{"rendered":"https:\/\/ziviz.us\/WP\/?p=198"},"modified":"2023-06-01T23:42:11","modified_gmt":"2023-06-02T03:42:11","slug":"event-forwarding-and-server-core","status":"publish","type":"post","link":"https:\/\/www.ziviz.net\/WP\/2023\/06\/01\/event-forwarding-and-server-core\/","title":{"rendered":"Event Forwarding and Server Core"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I setup Windows Event Forwarding on several servers to log to a Sever Core Event Collector server. I got the GPO setup and all. Since the collector is Core and has no option to open Event Viewer, I opened mmc.exe locally, and attached Event Viewer to remotely manage the Core server subscriptions. Once I was done, I tested it all and&#8230; nothing. The event source machines were throwing:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">The forwarder is having a problem communicating with subscription manager at address http:\/\/collectingserver:5985\/wsman\/SubscriptionManager\/WEC. Error code is 2150859027 and Error Message is The WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available. This is usually returned by a HTTP server that does not support the WS-Management protocol.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Turns out, the Subscriptions section of Event Viewer never manages the remote computer even if you selected a remote computer when attaching the snap-in. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What finally clued me in, is I checked the collector build with PowerShell against the remote core server, and nothing popped up. The whole time I thought I was managing the core server, I had instead been setting up the collector on my own machine. So yeah, either use a local instance of the Event Viewer snap-in or wecutil.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I setup Windows Event Forwarding on several servers to log to a Sever Core Event Collector server. I got the GPO setup and all. Since the collector is Core and has no option to open Event Viewer, I opened mmc.exe locally, and attached Event Viewer to remotely manage the Core server subscriptions. Once I was &hellip; <a href=\"https:\/\/www.ziviz.net\/WP\/2023\/06\/01\/event-forwarding-and-server-core\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Event Forwarding and Server Core&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,11],"tags":[],"class_list":["post-198","post","type-post","status-publish","format-standard","hentry","category-sysadmin","category-troubleshooting"],"_links":{"self":[{"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/posts\/198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/comments?post=198"}],"version-history":[{"count":1,"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/posts\/198\/revisions"}],"predecessor-version":[{"id":199,"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/posts\/198\/revisions\/199"}],"wp:attachment":[{"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/media?parent=198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/categories?post=198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ziviz.net\/WP\/wp-json\/wp\/v2\/tags?post=198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}