Hi,
May I know how to resolve this issue when adding generic windows event log on IDR?
1.Connection timed out: no further information
2. Unable to get details about the server
@hcelon typically the issue lies with WMI and DCOM permissions see
(Note this says troubleshooting active directory, but the same WMI method is used to collect generic windows events, so these troubleshooting steps still apply)
However we recommend using the logging.json feature of the agent to collect additional windows event instead of this event source.
It’s worth noting that we don’t recommend collecting all of these windows events from every machine, as this may cause a significant spike in data ingestion. Since this method of event collection will collect all System, Security and Application events.