Configuring Event Subscriptions

Using Event Viewer, you can view events on a single remote computer. However, troubleshooting an issue might require you to examine a set of events stored in multiple logs on multiple computers.

Windows Vista and later versions include the ability to collect and forward event information from multiple remote computers and store them centrally on the local computer. To specify which events you want to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. When a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events.

To use subscriptions, you must first configure the forwarding computers and the collector computer. Event collecting functionality relies upon the Windows Remote Management (WinRM) and Windows Event Collector (Wecsvc) services. The WinRM service must be running on both the remote and local computers participating in the forwarding and collecting process. The Wecsvc service needs to be running only on the collector computer because the source computer has a forwarding plug-in that runs in-process to WinRM.

To define a subscription, you must be an administrator on the collector computer. As part of the subscription definition, you define what security context should be used when accessing the logs on the source computers. This can be either a specific user account or the collector computer account. The specified account must have Read access to the logs on the source computers that are participating in the subscription. One way to set this up is to use a new built-in group called Event Log Readers to which you can add any accounts you want to give access to reading logs.

To configure computers to forward and collect events, follow these steps:

1. Log on to all collector and source computers, which must be running Windows Vista or later versions. If the computers are members of a domain, it is best to use a domain account with administrative privileges.
2. On each source computer, type winrm quickconfig at an elevated command prompt. When prompted, confirm that the changes should be made. To skip the prompt (for example, if you are using this command in a script), add the -q parameter.
3. On the collector computer, type wecutil qc at an elevated command prompt. (If you use Event Viewer, this will be done automatically for you on the collector.) When prompted, confirm that the changes should be made. To skip the prompt, add the /q:true parameter.
4. Add the computer account of the collector computer to the Event Log Readers group on each of the source computers if you will be using the computer account as the account to be used when collecting events. The advantage of using the collector computer account is that you don't need to deal with expiring passwords. However, if you do use a specific user account, you will need to add that account to the Event Log Readers instead of the collector computer account.

The computers are now configured to forward and collect events. Follow the steps described in the section titled "Creating a New Subscription" later in this tutorial to specify the events you want to have forwarded to the collector.

Note By default, the Local Users And Groups MMC snap-in does not allow you to add computer accounts. In the Select Users, Computers, Or Groups dialog box, click Object Types and then select the Computers check box. You will now be able to add computer accounts.

Note Beginning in Windows 7, you can now use the Set-WsManQuickConfig Windows PowerShell cmdlet to configure WinRM on the local computer. For more information, see http://technet.microsoft.com/en-us/library/dd819520.aspx.