{"id":2667,"date":"2016-06-28T15:52:39","date_gmt":"2016-06-28T13:52:39","guid":{"rendered":"http:\/\/vrealize.it\/?p=2667"},"modified":"2016-06-28T15:52:39","modified_gmt":"2016-06-28T13:52:39","slug":"windows-eventlog-proxy","status":"publish","type":"post","link":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/","title":{"rendered":"Windows Eventlog-Proxy"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-2671 alignleft\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png\" alt=\"event-proxy\" width=\"94\" height=\"180\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png 209w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy-105x200.png 105w\" sizes=\"auto, (max-width: 94px) 100vw, 94px\" \/>LogInsight unterst\u00fctzt das Log-Management f\u00fcr diverse Anwendungen von Drittanbietern wie ActiveDirectory, MS SQL und andere. Einige Installationen befinden sich allerdings in gesicherten Umgebungen, die es u.a. nicht erlauben, Software wie z.B. den LogInsight-Agenten auf die Systeme zu installieren. Um trotzdem ein Monitoring z.B. von einem gesicherten Domain-Controller zu erm\u00f6glichen, kann ein Proxy-System eingesetzt werden, das die LogInsight-Agenten-Installation erm\u00f6glicht, Daten vom Domain-Controller sammelt und an LogInsight weiterleitet.<\/p>\n<p>In diesem Artikel ist beschrieben, wie eine derartige Konfiguration in Verbindung mit einem Active Directory Domain Controller aufgebaut werden kann.<\/p>\n<h1><\/h1>\n<h1>Konfiguration des Proxy-Systems<\/h1>\n<p>Als Proxy-System dient ein herk\u00f6mmlicher Windows-Server. Versionell gibt es diesbzgl. keine direkten Voraussetzungen. Im Allgemeinen ist aber zu empfehlen, dass mindestens die Windows-Version eingesetzt wird, die auch der zu \u00fcberwachende Dienst (hier Domain Controller) hat. Daher wird in unserem Beispiel Windows 2012 R2 verwendet. Um als Log-Empf\u00e4nger dienen zu k\u00f6nnen, muss das Computer-Objekt des Collector-Servers in die Gruppe der \u201eEvent Log Readers\u201c im AD aufgenommen werden. Das setzt nat\u00fcrlich auch voraus, dass der Server Mitglied der Dom\u00e4ne ist. Die einzelnen Schritte dazu sind in Screenshots beschrieben:<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-2652 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-01-600x209.png\" alt=\"LI-EVTPROXY-01\" width=\"600\" height=\"209\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-01-600x209.png 600w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-01-200x70.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-01-300x104.png 300w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-01-660x230.png 660w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-01.png 667w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2653 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-02.png\" alt=\"LI-EVTPROXY-02\" width=\"407\" height=\"474\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-02.png 407w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-02-172x200.png 172w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-02-300x349.png 300w\" sizes=\"auto, (max-width: 407px) 100vw, 407px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2654 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-03.png\" alt=\"LI-EVTPROXY-03\" width=\"508\" height=\"291\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-03.png 508w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-03-200x115.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-03-300x172.png 300w\" sizes=\"auto, (max-width: 508px) 100vw, 508px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2655 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-04.png\" alt=\"LI-EVTPROXY-04\" width=\"466\" height=\"250\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-04.png 466w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-04-200x107.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-04-300x161.png 300w\" sizes=\"auto, (max-width: 466px) 100vw, 466px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2656 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-05.png\" alt=\"LI-EVTPROXY-05\" width=\"408\" height=\"469\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-05.png 408w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-05-174x200.png 174w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-05-300x345.png 300w\" sizes=\"auto, (max-width: 408px) 100vw, 408px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Des Weiteren muss das Sammeln von Event Informationen auf dem Collector-Host konfiguriert werden. Dazu werden \u00fcber das Computer Management sog. Subscriptions angelegt. Beim ersten \u00d6ffnen der Funktion erscheint eine Dialogmeldung, die bei Best\u00e4tigung mit \u201eyes\u201c den dazu erforderlichen Dienst startet.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-2657 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-600x296.png\" alt=\"LI-EVTPROXY-06\" width=\"600\" height=\"296\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-600x296.png 600w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-200x99.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-768x379.png 768w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-1024x506.png 1024w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-300x148.png 300w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06-660x326.png 660w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-06.png 1112w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p>Mittels rechter Maustaste kann nun eine neue Subscription angelegt werden. Dazu ist es erforderlich, einen Namen f\u00fcr die Subscription zu vergeben und auch zu hinterlegen, welches lokale Log (auf dem Collector) als Zielkontainer f\u00fcr die gesammelten Logdaten verwendet werden soll. Per default ist hier das Log \u201eForwarded Events\u201c selektiert, das bei Bedarf auch abge\u00e4ndert werden kann. Wichtig ist, dass auch bei der sp\u00e4teren Konfiguration des LogInsight-Agenten hier auf das richtige Log verwiesen wird.<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2658 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-07.png\" alt=\"LI-EVTPROXY-07\" width=\"583\" height=\"488\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-07.png 583w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-07-200x167.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-07-300x251.png 300w\" sizes=\"auto, (max-width: 583px) 100vw, 583px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>\u00a0<\/strong>In einem weiteren Schritt muss nun der Quell-Host (Domain Controller) im Bereich \u201eCollector initiated\u201c ausgew\u00e4hlt werden, um der Subscription mitzuteilen, von welchem System es die Log-Daten empfangen soll.<\/p>\n<p><strong>\u00a0<img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2659 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-08.png\" alt=\"LI-EVTPROXY-08\" width=\"493\" height=\"306\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-08.png 493w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-08-200x124.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-08-300x186.png 300w\" sizes=\"auto, (max-width: 493px) 100vw, 493px\" \/><\/strong><\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<p>\u00dcber die Funktion \u201eevents to collect\u201c kann noch ausgew\u00e4hlt werden, welche Eventdaten \u00fcberhaupt gesammelt werden. Dieses Beispiel wurde so konfiguriert, dass alle Events des Quellsystems zu jeder Zeit erfasst werden:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2660 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-09.png\" alt=\"LI-EVTPROXY-09\" width=\"549\" height=\"551\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-09.png 549w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-09-200x200.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-09-300x301.png 300w\" sizes=\"auto, (max-width: 549px) 100vw, 549px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Da das Collector-System i.d.R. nicht alle Eventsektionen des Ursprungsservers kennt, ist es erforderlich, weitere Sektionen (wie z.B. Directory Services oder DNS Server) per XML-Konfiguration zu erg\u00e4nzen:<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2661 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-10.png\" alt=\"LI-EVTPROXY-10\" width=\"182\" height=\"75\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2662 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-11.png\" alt=\"LI-EVTPROXY-11\" width=\"546\" height=\"548\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-11.png 546w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-11-200x200.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-11-300x301.png 300w\" sizes=\"auto, (max-width: 546px) 100vw, 546px\" \/><\/p>\n<p>Dar\u00fcber hinaus ist folgender Artikel hilfreich, um die richtige Interpretation der Events zu bewirken, die im Collector-System nicht bekannt sind:<\/p>\n<p><a href=\"http:\/\/www.gorlani.com\/portal\/articles\/windows-event-forwarding-and-missing-event-text\">http:\/\/www.gorlani.com\/portal\/articles\/windows-event-forwarding-and-missing-event-text<\/a><\/p>\n<p>Um die Zeit f\u00fcr die Weiterleitung der Events zu optimieren, empfiehlt es sich, die \u201eevent delivery optimization\u201c in den Advanced Settings auf \u201eminimize latency\u201c zu setzen:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2663 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-12.png\" alt=\"LI-EVTPROXY-12\" width=\"499\" height=\"370\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-12.png 499w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-12-200x148.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-12-300x222.png 300w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Nun sollte bereits das \u201eForwarded Events\u201c Log im Collector gef\u00fcllt werden, sobald entsprechende Events auf dem Domain Controller auftauchen. Allerdings d\u00fcrfte bei den meisten Events die Beschreibung nicht korrekt wiedergegeben sein. Um dies zu beheben, ist es erforderlich, einen Befehl auf dem Collector-Host auszuf\u00fchren der das Inhaltsformat der Log-Informationen entsprechend anpasst:<\/p>\n<p>&nbsp;<\/p>\n<pre class=\"\">wecutil ss SUBSCRIPTIONNAME \/cf:Events<\/pre>\n<p>&nbsp;<\/p>\n<p>Mehr Informationen auch unter:<\/p>\n<p><a href=\"https:\/\/social.technet.microsoft.com\/Forums\/windows\/en-US\/8694cea6-6386-489d-bab8-cd619a00fb99\/windows-2008-r2-event-collector-server-subscription-issues?forum=windowsserver2008r2management\">https:\/\/social.technet.microsoft.com\/Forums\/windows\/en-US\/8694cea6-6386-489d-bab8-cd619a00fb99\/windows-2008-r2-event-collector-server-subscription-issues?forum=windowsserver2008r2management<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Sobald erfolgreich Meldungen am Collector Host im \u201eForwarded Events\u201c Log erscheinen, war die Konfiguration erfolgreich:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-2664 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-600x117.png\" alt=\"LI-EVTPROXY-13\" width=\"600\" height=\"117\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-600x117.png 600w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-200x39.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-768x149.png 768w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-1024x199.png 1024w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-300x58.png 300w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13-660x128.png 660w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-13.png 1359w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Letztlich ist nur noch zu verifizieren, dass auch ein LogInsight-Agent auf dem Collector-System l\u00e4uft und sich dieser erfolgreich in LogInsight registriert hat.<\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<h1>Konfiguration des LogInsight-Agenten<\/h1>\n<p>&nbsp;<\/p>\n<p>Wie in LogInsight \u00fcblich, erfolgt die Konfiguration des Agenten von zentraler Stelle aus. Im Allgemeinen empfiehlt es sich, eine eigene Gruppe f\u00fcr Windows-Server anzulegen.<\/p>\n<p>&nbsp;<\/p>\n<p>Bitte beachten: Hier ist der interne Name des Eventlogs anzugeben, nicht der Anzeigename. In meinem Fall war der Anzeigename \u201eForwarded Events\u201c und der interne Name \u201eForwardedEvents\u201c (ohne Leerzeichen). Der interne Name kann per Kontextmen\u00fc &#8211;&gt; Properties (im Event-Viewer) ausgelesen werden.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-2665 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14-600x499.png\" alt=\"LI-EVTPROXY-14\" width=\"600\" height=\"499\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14-600x499.png 600w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14-200x166.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14-768x639.png 768w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14-300x250.png 300w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14-660x549.png 660w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-14.png 1010w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Bei erfolgreicher Konfiguration erscheinen nun Event-Meldungen des Active-Directory-Servers am LogInsight Server. Die Meldungen enthalten dabei auch den AD-Server als Quelle:<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-2666 aligncenter\" src=\"http:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-600x386.png\" alt=\"LI-EVTPROXY-15\" width=\"600\" height=\"386\" srcset=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-600x386.png 600w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-200x129.png 200w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-768x494.png 768w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-1024x658.png 1024w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-300x193.png 300w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15-660x424.png 660w, https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/LI-EVTPROXY-15.png 1274w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>LogInsight unterst\u00fctzt das Log-Management f\u00fcr diverse Anwendungen von Drittanbietern wie ActiveDirectory, MS SQL und andere. Einige Installationen befinden sich allerdings in gesicherten Umgebungen, die es u.a. nicht erlauben, Software wie z.B. den LogInsight-Agenten auf die Systeme zu installieren. Um trotzdem ein Monitoring z.B. von einem gesicherten Domain-Controller zu erm\u00f6glichen, kann ein Proxy-System eingesetzt werden, das\u2026 <span class=\"read-more\"><a href=\"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/\">Weiterlesen &raquo;<\/a><\/span><\/p>\n","protected":false},"author":20,"featured_media":2671,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[42,11],"tags":[],"class_list":["post-2667","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-loginsight","category-unkategorisiert"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Windows Eventlog-Proxy &#187; vrealize.it - TechBlog VMware SDDC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Windows Eventlog-Proxy &#187; vrealize.it - TechBlog VMware SDDC\" \/>\n<meta property=\"og:description\" content=\"LogInsight unterst\u00fctzt das Log-Management f\u00fcr diverse Anwendungen von Drittanbietern wie ActiveDirectory, MS SQL und andere. Einige Installationen befinden sich allerdings in gesicherten Umgebungen, die es u.a. nicht erlauben, Software wie z.B. den LogInsight-Agenten auf die Systeme zu installieren. Um trotzdem ein Monitoring z.B. von einem gesicherten Domain-Controller zu erm\u00f6glichen, kann ein Proxy-System eingesetzt werden, das\u2026 Weiterlesen &raquo;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/\" \/>\n<meta property=\"og:site_name\" content=\"vrealize.it - TechBlog VMware SDDC\" \/>\n<meta property=\"article:published_time\" content=\"2016-06-28T13:52:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png\" \/>\n\t<meta property=\"og:image:width\" content=\"209\" \/>\n\t<meta property=\"og:image:height\" content=\"399\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Christian Ferber\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christian Ferber\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"3\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/\"},\"author\":{\"name\":\"Christian Ferber\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/#\\\/schema\\\/person\\\/b9a1d86cf0dd18846d25e3db68257a48\"},\"headline\":\"Windows Eventlog-Proxy\",\"datePublished\":\"2016-06-28T13:52:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/\"},\"wordCount\":673,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/vrealize.it\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/event-proxy.png\",\"articleSection\":[\"Aria Operations for Logs\",\"Unkategorisiert\"],\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/\",\"url\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/\",\"name\":\"Windows Eventlog-Proxy &#187; vrealize.it - TechBlog VMware SDDC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/vrealize.it\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/event-proxy.png\",\"datePublished\":\"2016-06-28T13:52:39+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/#\\\/schema\\\/person\\\/b9a1d86cf0dd18846d25e3db68257a48\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#primaryimage\",\"url\":\"https:\\\/\\\/vrealize.it\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/event-proxy.png\",\"contentUrl\":\"https:\\\/\\\/vrealize.it\\\/wp-content\\\/uploads\\\/2016\\\/06\\\/event-proxy.png\",\"width\":209,\"height\":399},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/2016\\\/06\\\/28\\\/windows-eventlog-proxy\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/vrealize.it\\\/de\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Windows Eventlog-Proxy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/#website\",\"url\":\"https:\\\/\\\/vrealize.it\\\/de\\\/\",\"name\":\"vrealize.it - TechBlog VMware SDDC\",\"description\":\"Information zu sicherem Hybrid und Multi-Cloud Computing - dispruptive Technologien im IT- Umfeld\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/vrealize.it\\\/de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/vrealize.it\\\/de\\\/#\\\/schema\\\/person\\\/b9a1d86cf0dd18846d25e3db68257a48\",\"name\":\"Christian Ferber\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/94e934a8772605c4e00d3934283e9f2e519d6b46495f702f98a3ea3642fcd99a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/94e934a8772605c4e00d3934283e9f2e519d6b46495f702f98a3ea3642fcd99a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/94e934a8772605c4e00d3934283e9f2e519d6b46495f702f98a3ea3642fcd99a?s=96&d=mm&r=g\",\"caption\":\"Christian Ferber\"},\"description\":\"Christian has joined VMware in July 2015 as Senior Systems Engineer Cloud Management. Through his work in various cloud projects before and at VMware he has gained experience in datacenter, server, storage, networking and cloud management technologies. Today his primary focus is on automation and operation topics with integration into many surrounding solutions like containers, configuration management, directory services and others. He is responsible for the management components in the VMware Cloud Foundation (VCF) product family for enterprise customers in Germany.\",\"url\":\"https:\\\/\\\/vrealize.it\\\/de\\\/author\\\/cferber\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Windows Eventlog-Proxy &#187; vrealize.it - TechBlog VMware SDDC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/","og_locale":"de_DE","og_type":"article","og_title":"Windows Eventlog-Proxy &#187; vrealize.it - TechBlog VMware SDDC","og_description":"LogInsight unterst\u00fctzt das Log-Management f\u00fcr diverse Anwendungen von Drittanbietern wie ActiveDirectory, MS SQL und andere. Einige Installationen befinden sich allerdings in gesicherten Umgebungen, die es u.a. nicht erlauben, Software wie z.B. den LogInsight-Agenten auf die Systeme zu installieren. Um trotzdem ein Monitoring z.B. von einem gesicherten Domain-Controller zu erm\u00f6glichen, kann ein Proxy-System eingesetzt werden, das\u2026 Weiterlesen &raquo;","og_url":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/","og_site_name":"vrealize.it - TechBlog VMware SDDC","article_published_time":"2016-06-28T13:52:39+00:00","og_image":[{"width":209,"height":399,"url":"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png","type":"image\/png"}],"author":"Christian Ferber","twitter_card":"summary_large_image","twitter_misc":{"Verfasst von":"Christian Ferber","Gesch\u00e4tzte Lesezeit":"3\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#article","isPartOf":{"@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/"},"author":{"name":"Christian Ferber","@id":"https:\/\/vrealize.it\/de\/#\/schema\/person\/b9a1d86cf0dd18846d25e3db68257a48"},"headline":"Windows Eventlog-Proxy","datePublished":"2016-06-28T13:52:39+00:00","mainEntityOfPage":{"@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/"},"wordCount":673,"commentCount":0,"image":{"@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#primaryimage"},"thumbnailUrl":"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png","articleSection":["Aria Operations for Logs","Unkategorisiert"],"inLanguage":"de","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/","url":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/","name":"Windows Eventlog-Proxy &#187; vrealize.it - TechBlog VMware SDDC","isPartOf":{"@id":"https:\/\/vrealize.it\/de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#primaryimage"},"image":{"@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#primaryimage"},"thumbnailUrl":"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png","datePublished":"2016-06-28T13:52:39+00:00","author":{"@id":"https:\/\/vrealize.it\/de\/#\/schema\/person\/b9a1d86cf0dd18846d25e3db68257a48"},"breadcrumb":{"@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#primaryimage","url":"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png","contentUrl":"https:\/\/vrealize.it\/wp-content\/uploads\/2016\/06\/event-proxy.png","width":209,"height":399},{"@type":"BreadcrumbList","@id":"https:\/\/vrealize.it\/de\/2016\/06\/28\/windows-eventlog-proxy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/vrealize.it\/de\/"},{"@type":"ListItem","position":2,"name":"Windows Eventlog-Proxy"}]},{"@type":"WebSite","@id":"https:\/\/vrealize.it\/de\/#website","url":"https:\/\/vrealize.it\/de\/","name":"vrealize.it - TechBlog VMware SDDC","description":"Information zu sicherem Hybrid und Multi-Cloud Computing - dispruptive Technologien im IT- Umfeld","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/vrealize.it\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Person","@id":"https:\/\/vrealize.it\/de\/#\/schema\/person\/b9a1d86cf0dd18846d25e3db68257a48","name":"Christian Ferber","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/secure.gravatar.com\/avatar\/94e934a8772605c4e00d3934283e9f2e519d6b46495f702f98a3ea3642fcd99a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/94e934a8772605c4e00d3934283e9f2e519d6b46495f702f98a3ea3642fcd99a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/94e934a8772605c4e00d3934283e9f2e519d6b46495f702f98a3ea3642fcd99a?s=96&d=mm&r=g","caption":"Christian Ferber"},"description":"Christian has joined VMware in July 2015 as Senior Systems Engineer Cloud Management. Through his work in various cloud projects before and at VMware he has gained experience in datacenter, server, storage, networking and cloud management technologies. Today his primary focus is on automation and operation topics with integration into many surrounding solutions like containers, configuration management, directory services and others. He is responsible for the management components in the VMware Cloud Foundation (VCF) product family for enterprise customers in Germany.","url":"https:\/\/vrealize.it\/de\/author\/cferber\/"}]}},"_links":{"self":[{"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/posts\/2667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/comments?post=2667"}],"version-history":[{"count":5,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/posts\/2667\/revisions"}],"predecessor-version":[{"id":2673,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/posts\/2667\/revisions\/2673"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/media\/2671"}],"wp:attachment":[{"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/media?parent=2667"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/categories?post=2667"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vrealize.it\/de\/wp-json\/wp\/v2\/tags?post=2667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}