Understanding Windows Event Collection (WEC/WEF): Planning, Troubleshooting and Performance Monitoring

Webinar Registration

Working with some large customer WEC/WEF implementations, we’ve been really pushing the envelope on what Windows’ native event forwarding can do and we’ve learned a lot. In this highly technical event, we’ll share that with you.

First, I’ll start off with a quick overview for new comers to WEC and explain how it works. Windows Event Collection eliminates polling and agents. WEC is built into Windows. It's already there on every system on your network. There's no agent to install. But it's even more efficient than an agent. And forget about polling. Instead WEC allows you to optimize endpoints to send the important events and leave the noise behind.

Then we’ll dive into our latest findings about running large WEC installations such as:

  • Why you can stop worrying about the Events Lost performance counter
  • The only reliable way to determine if WEC really has stopped collecting events
  • How to accurately track Events Logged per Second
  • Performance counters specific to WEC
  • How to identify bottlenecks on collectors
  • What happens when you disable a subscription?
  • When should you use multiple destination logs?
  • Should you combine multiple source logs into one subscription or create a different subscription for each source log?

And troubleshooting like:

  • Diagnosing a problem forwarder
  • How to fix 2016 and later collectors that won’t collect events due to a urlacl problem
  • How to make forwarders see new group memberships without rebooting
  • How to identity an overloaded collector

We’ll also give a sneak peak at a revolutionary new way to load balance Windows Event Collectors that is faster, simpler and eliminates the latency and complication associated with Active Directory group membership and computers.

If you are new to WEC, I suggest you watch some of my previous webinars on this subject prior to attending this event, so that you can get the most from this advanced content. Webinars such as:

LOGbinder is our sponsor and you’ll briefly see the latest advancements in Supercharger 2019.10.

Please join us for this real training for free session.

First Name:   
Last Name:   
Work Email:  
Job Title:  
How long have you been using native Windows Event Collection in production?:
How many Windows servers in your organization? :
How many Windows workstations in your organization?:

Your information will be shared with the sponsor.

By clicking "Submit", you're agreeing to our Privacy Policy and consenting to be contacted by us and the sponsor.



Additional Resources