- play_arrow What's New in WinCollect
- play_arrow WinCollect Overview
- play_arrow Installation Prerequisites for WinCollect
- play_arrow WinCollect installations
- WinCollect installations
- Installing and Upgrading the WinCollect Application on JSA Appliances
- Creating an Authentication Token for WinCollect Agents
- Adding Multiple Destinations to WinCollect Agents
- Migrating WinCollect Agents After a JSA Hardware Upgrade
- Stand-alone WinCollect Installations
- WinCollect Configuration Console Overview
- Installing the Configuration Console
- Silently Installing, Upgrading, and Uninstalling WinCollect Software
- Setting an XPath Parameter During Automated Installation
- Migrating from Adaptive Log Exporter to WinCollect
- Installing the WinCollect Agent on a Windows Host
- Installing a WinCollect Agent from the Command Prompt
- Uninstalling a WinCollect Agent from the Command Prompt
- Uninstalling a WinCollect Agent from the Control Panel
- play_arrow Configuring WinCollect Agents After Installation
- Configuring WinCollect Agents After Installation
- Manually Adding a WinCollect Agent
- Deleting a WinCollect Agent
- WinCollect Destinations
- Adding Custom Entries to WinCollect Status Messages
- Forwarding Events Identifier
- Configuring Stand-alone WinCollect Agents with the Configuration Console
- Creating a WinCollect Credential
- Adding a Destination to the WinCollect Configuration Console
- Configuring a Destination with TLS in the WinCollect Configuration Console
- Adding a Device to the WinCollect Configuration Console
- Sending Encrypted Events to JSA
- Increasing UDP Payload Size
- Include Milliseconds in Event Log Timestamp
- Collecting Local Windows Logs
- Collecting Remote Windows Logs
- Changing configuration with Templates in a Stand-alone Deployment
- Configuration Options for Systems with Restricted Policies for Domain Controller Credentials
- play_arrow Troubleshooting WinCollect Deployment Issues
- Troubleshooting WinCollect Deployment Issues
- Common Problems
- Replacing the Default Certificate in JSA Generates Invalid PEM Errors
- The Statistics Subsystem
- Event ID 1003 Splits the Message in JSA
- WinCollect Files are Not Restored During a Configuration Restore
- Windows 10 (1803) Cannot Read the Security Bookmark File
- Resolving Log Source Error After WinCollect Update
- WinCollect Log File
Microsoft IAS Log Source Configuration Options
Use the reference information to configure the WinCollect plug-in for Microsoft IAS.
Microsoft IAS | Supported Versions |
|---|---|
MicrosoftWindows support | Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 |
NPS log server log formats | Data Transformation Service Open Database Connectivity Internet Authentication Service |
WinCollect does not support events that are logged to a Microsoft SQL Server.
Microsoft IAS Directory Structure for Event Collection
The event logs that are monitored by WinCollect are defined by the root directory that you should configure in your log source.
When you specify a root log directory, you must point the WinCollect agent to the folder that contains your Microsoft IAS or NPS events. The root log directory does not recursively search sub-directories for event files.
To improve performance, you can create a sub folder for your IAS and NPS event logs, for example, \WINDOWS\System32\Logfiles\NPS. When you create a specific event folder, the agent does not have to evaluate many files to locate your event logs.
If your system generates a large number of IAS or NPS events, you can configure your Windows system to create a new event log at daily intervals. This action ensures that agents do not have to search large logs for new events.
Event version | Root Log Directory |
|---|---|
MicrosoftWindows Server 2019 | \Windows\System32\Logfiles\ |
MicrosoftWindows Server 2016 | \Windows\System32\Logfiles\ |
MicrosoftWindows Server 2012 R2 | \Windows\System32\Logfiles\ |
Microsoft IAS Protocol Parameters
Parameter | Description |
|---|---|
Log Source Type | Microsoft IAS Server |
Protocol Configuration | WinCollect Microsoft IAS / NPS |
Local System | To collect local events, the WinCollect agent must be installed on the same host as your Microsoft DHCP Server. The log source uses local system credentials to collect and forward events to the JSA. |
File Monitor Policy | The Notification-based (local) option uses the Windows file system notifications to detect changes to your event log. The Polling-based (remote) option monitors changes to remote files and directories. The agent polls the remote event log and compares the file to the last polling interval. If the event log contains new events, the event log is retrieved. |
Polling Interval | The amount of time between queries to the root log directory for new events. |
