Templates/Template-Collector.xml
<?xml version="1.0" encoding="UTF-8"?>
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription"> <SubscriptionId>Template Name</SubscriptionId> <SubscriptionType>CollectorInitiated</SubscriptionType> <Description> </Description> <Enabled>true</Enabled> <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri> <ConfigurationMode>Custom</ConfigurationMode> <Delivery Mode="Pull"> <Batching> <MaxItems>1</MaxItems> <MaxLatencyTime>1000</MaxLatencyTime> </Batching> <PushSettings> <Heartbeat Interval="40000" /> </PushSettings> </Delivery> <Query>This query will be filled automatically</Query> <ReadExistingEvents>false</ReadExistingEvents> <TransportName>HTTP</TransportName> <TransportPort>5985</TransportPort> <ContentFormat>Events</ContentFormat> <Locale Language="en-US" /> <LogFile>ForwardedEvents</LogFile> <PublisherName>Microsoft-Windows-EventCollector</PublisherName> <CredentialsType>Default</CredentialsType> <EventSources> <!--Server sources will go in here--> </EventSources> </Subscription> |