Understanding Windows Event Collection (WEC/WEF): Planning, Troubleshooting and Performance Monitoring

Working with some large customer WEC/WEF implementations, we’ve been really pushing the envelope on what Windows’ native event forwarding can do and we’ve learned a lot. In this highly technical event, we’ll share that with you.

First, I’ll start off with a quick overview for new comers to WEC and explain how it works. Windows Event Collection eliminates polling and agents. WEC is built into Windows. It's already there on every system on your network. There's no agent to install. But it's even more efficient than an agent. And forget about polling. Instead WEC allows you to optimize endpoints to send the important events and leave the noise behind.

Then we’ll dive into our latest findings about running large WEC installations such as:

• Why you can stop worrying about the Events Lost performance counter
• The only reliable way to determine if WEC really has stopped collecting events
• How to accurately track Events Logged per Second
• Performance counters specific to WEC
• How to identify bottlenecks on collectors
• What happens when you disable a subscription?
• When should you use multiple destination logs?
• Should you combine multiple source logs into one subscription or create a different subscription for each source log?

And troubleshooting like:

• Diagnosing a problem forwarder
• How to fix 2016 and later collectors that won’t collect events due to a urlacl problem
• How to make forwarders see new group memberships without rebooting
• How to identity an overloaded collector

We’ll also give a sneak peak at a revolutionary new way to load balance Windows Event Collectors that is faster, simpler and eliminates the latency and complication associated with Active Directory group membership and computers.

If you are new to WEC, I suggest you watch some of my previous webinars on this subject prior to attending this event, so that you can get the most from this advanced content. Webinars such as:

• It’s Time to Unleash the Power of Native Windows Event Collection
• Managing Large Windows Event Collection Implementations: Load Balancing Across Multiple Collectors
• Integrating Splunk with native Windows Event Collection (WEC) and Optional 2-Stage Noise Filtering
• LogRhythm and Native Windows Event Forwarding: How to Do It Right, Filter the Noise and Simplify your Infrastructure
• QRadar WinCollect and Native Windows Event Collection: How to Do It Right, Filter the Noise and Simplify your Infrastructure
• XPath Deep Dive: Building Advanced Filters for Windows Event Collection
• Building a Resilient Logging Pipeline: Windows Event Collection Tips and Tricks for When You Are Serious About Log Collection

LOGbinder is our sponsor and you’ll briefly see the latest advancements in Supercharger 2019.10.

Please join us for this real training for free session.