InTrust 11.4 Custom Data source

Hi Payank Shah,

I beg your pardon, but the set of logs you mentioned is so manifold that I cannot give you a certain answer.

Generally, the text logs can be configured only in "InTrust Manager" and collected only on schedule, not in real-time.

Erro*.log, log_*.trc, system_health_*.xel: these three are from SQL folder, aren't they? Error log can be collected by existing InTrust data source named "Microsoft SQL Server Error Log", other two are binary, not text ones.

Under Windows Firewall log do you mean "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" log which can be found in event viewer? (%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx). If yes, then it can be collected both on schedule and in real-time way if you add it in "InTrust Manager" or "InTrust Deployment Manager".

All other log names and folders I did not find on my desktop, sorry.

I propose the following procedure: Please focus on one log, create a separate topic here on this forum and provide the log example, I mean a dozen of lines from the log . I will grab it and help to create the InTrust Data Source.

Thx for the Answer Igor.

Using SQL server data source i was able to try collect err*.log.   But since This and pfirewall.log are text and as you said they have to be scheduled how do you forward this events?  Since forwarding capability are only in InTrust Deployment Manager console. 

Unfortunately we cannot forward events collected on schedule, sorry. The second thing is that we forward only named strings of events, and even if we create a custom solution for you to forward arbitrary text logs, they will come to a destination host as empty events. I will pass your request to InTrust Product Manager.

Unfortunately we cannot forward events collected on schedule, sorry. The second thing is that we forward only named strings of events, and even if we create a custom solution for you to forward arbitrary text logs, they will come to a destination host as empty events. I will pass your request to InTrust Product Manager.