Windows Event Forwarding (Windows Agent)

Download PDF

Forward Windows Event Log entries to LogZilla over HTTP or HTTPS with the LogZilla Syslog Agent for Windows: download, install, configure, upgrade

Windows Event Forwarding (Windows Agent)

Windows does not natively send syslog. The LogZilla Syslog Agent for Windows is a Windows service that monitors Windows Event Logs and forwards events to LogZilla over HTTP or HTTPS. It supports primary and secondary servers, event filtering, and catch-up processing for events logged while the service was stopped.

The agent's README in its GitHub repository is the reference for every setting and screenshot. The sections below summarize it.

Download

System requirements

  • Windows Server 2016 or later, or Windows 10/11 (64-bit)
  • 100 MB RAM and 50 MB of disk space
  • HTTP or HTTPS connectivity to the LogZilla server
  • Administrator privileges for installation
  • A LogZilla API key for authentication

Installation

  1. Install the Microsoft Windows app in LogZilla first (Settings → Appstore) so events are parsed from the first message.
  2. Open the winagent-releases repository on GitHub, click Releases in the right-hand sidebar, scroll to the bottom of the release page to its assets, and download LogZilla_Winagent.msi. The direct Releases link skips the first click.
  3. Right-click LogZilla_Winagent.msi, select Run as administrator, and follow the wizard. The installer places the service (SyslogAgent.exe) and the configuration tool (SyslogAgentConfig.exe) in C:\Program Files\LogZilla\SyslogAgent, registers the Windows Event Log source "LogZilla SyslogAgent", and creates registry keys under HKLM\SOFTWARE\LogZilla\SyslogAgent.
  4. After installation the service exists but is not running. It is configured and started with the configuration tool.

Configuration

Launch Syslog Agent Configuration from the Start menu, or run C:\Program Files\LogZilla\SyslogAgent\SyslogAgentConfig.exe.

Servers

  • Primary LogZilla server: the server URL, for example https://logzilla.example.com. Use http:// for unencrypted connections or https:// for TLS.
  • Primary LogZilla API Key: an API key created in LogZilla under Settings → API Keys → Create Key.
  • Primary Use Self-Signed Cert: only for HTTPS with a self-signed certificate. Check it and use Select Primary Cert to choose the .pem file.
  • Secondary LogZilla server: optional. When enabled, the agent sends every event to both servers. Select LogZilla Compatible Version for each server, or use detect.

Event logs and selection

  • Event Logs: the channels to monitor. The default selection is Application, Security, and System.
  • Event Selection Mode: Ignore forwards all events (default); Include forwards only the comma-separated Event IDs listed, for example 4624,4625,4726.
  • Catch-up (default) processes the backlog when the service starts; Only while running skips events logged while the service was stopped.

Message content

  • Look up account IDs: resolve SIDs to user names (recommended).
  • Facility: syslog facility, default Local4.
  • Severity: Dynamic (recommended) maps Windows event levels to syslog severity; a fixed severity can be selected instead.
  • Extra key/values: custom fields added to every event, for example "environment":"production","datacenter":"us-east". They arrive in extra_fields and are available to LogZilla rules.
  • Max Batch Size (default 1000 events) and Max Batch Age (ms) (default 1000) control batching.

Logging

Logging is off by default (Log Level NONE) and is intended for troubleshooting with LogZilla support. When a level is set, Log File Name is the path of the debug log.

File watcher (tail mode)

New lines of a text file can be forwarded as events: set File Name to the file path and Program Name to the value that appears in LogZilla's program field.

Save and start

Click Save to write the configuration to the registry, then Start. The status line at the bottom reads Agent service is running.

Delivery endpoint and authentication

The agent sends HTTP or HTTPS POST requests to the LogZilla HTTP Receiver at the /incoming path and authenticates with the API key.

  • Example endpoint: https://logzilla.example.com/incoming
  • Token header examples are documented in HTTP Event Receiver.

Upgrading

The MSI installer upgrades in place: download the new LogZilla_Winagent.msi and run it without uninstalling. The installer stops the service (waiting up to 120 seconds for the queue to drain), keeps the registry configuration, replaces the binaries, and restarts the service. The installed version is shown in the bottom-left corner of Syslog Agent Configuration.

Verification

  • In LogZilla, events from the Windows host appear within seconds in the Events view or on a dashboard. After parsing, events from the agent carry these extra fields:
    • _source_type: windows_agent
    • _log_type: eventlog (or file for File Watcher events)
    • event_id, event_log
  • On the Windows host, the Application log records the agent's own events under the source LogZilla SyslogAgent. Event ID 1000 is a successful service start; 1001 and 1002 report queue overflow and drop counts.
  • For receiver-side checks, see HTTP Event Receiver. For network captures, see Syslog Troubleshooting.

LogZilla Windows App

The Microsoft Windows app (Settings → Appstore) parses and tags the events the agent sends. Its README lists the extracted fields, the MITRE ATT&CK mapping, and the shipped triggers.

Windows Event Forwarding (Windows Agent) | LogZilla Documentation