Why you need centralized event logging (Windows)

It will hit you, eventually.  You'll be sitting at your desk browsing through Kibana data and suddenly realize that it's been WEEKS since you last opened event viewer on a server.  And waited for it to load.  And then had to activate filters.  And then discover that your log entry is on another server.

Get the ELK stack.  Just try it out.  NXlog, ELK, and a browser.  Done.  You don't need to be a Linux guru (although some experience helps).

It is a lovely feeling.

Also, when people come to you and say, 'hey man, I love this new system - it saves me so much time! Thank you!', you'll be all 'cool man.  cool.'.  And you'll then also have that wonderful feeling that what you are doing actually matters.  Fun times!

Comments

Popular posts from this blog

DFSR - eventid 4312 - replication just won't work

Fixing duplicate SPNs (service principal name)

Logstash to Nagios - alerting based on Windows Event ID