Product documentation
uberAgent
Current Release (7.5.x) 7.4.x 7.4.0 7.3.1 7.3.0 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0
View PDF

Event Log Forwarding

December 11, 2025
Contributed by: 
C

uberAgent® can collect Windows system logs like Application, Security, System, etc. Events can be filtered based on their provider, event ID, and level (Information, Error, etc.). Additionally, more fine-grained event-filtering is possible with the XPath-querying functionality.

Requirements

  • Eventlog forwarding is supported on Windows and macOS
  • uberAgent 7.3 or later on Windows, uberAgent 7.5 or later on macOS

Configuring Eventlog Forwarding for Windows

Eventlog forwarding is configured with a configuration file. By default, no logs are collected. Eventlog collection needs to be enabled by an administrator.

The [EventLog] Stanza

The stanza [EventLog] starts a new log configuration, followed by multiple settings.

Setting Description Required Values
EventLog The name of the event log to query. Yes Any valid log name, like System.
LevelName The event’s level. Specify multiple levels separated by commas. Yes Information, Warning, Error, Critical, Verbose
EventID Limit the collection to specific event IDs. Specify multiple IDs separated by commas. No Any valid event IDs
EventFilterXPath Limit the collection with a XPath filter. XPath uses path expressions to select nodes or node-sets in an XML document. The node is selected by following a path or steps. No Any valid XPath filter.
Provider Limit the collection to specific providers. No Any valid provider name.

Collection Frequency

Eventlogs can be queried on a configurable schedule, or on-demand.

Schedule

To schedule the log collection, first create a new [EventLog] stanza.

[EventLog Name=TimerBased-System-Errors-Warnings]
EventLog = System
LevelName = Error,Warning
<!--NeedCopy-->

Second, create a new timer and reference the name the Eventlog stanza’s name.

[Timer]
Name = System Eventlog collection
EventLog = TimerBased-System-Errors-Warnings
Interval = 60000
<!--NeedCopy-->

On-demand

Create a new [EventLog] stanza without a corresponding timer. When uberAgent can’t find the Eventlog stanza’s name in any timer, it collects events as they occur.

[EventLog Name=OnDemand-Security-Events]
EventLog = Security
LevelName=Information
<!--NeedCopy-->

Collecting events as they occur can be resource intensive. Hence, collecting on a schedule is the preferred option.

Configuring Eventlog Forwarding for macOS

As with Windows, Eventlog forwarding is configured using a configuration file. By default, no logs are collected. Eventlog collection must be configured and enabled by an administrator.

The [EventLog] Stanza

The stanza [EventLog] starts a new log configuration, followed by multiple settings.

Setting Description Required Example
Predicate A valid predicate filter (see the man page for the log command) Yes process == “uberAgent”
RateLimit Specifies the maximum number of messages to retrieve per timer interval. The default is 500. No 1000
MaxMessageLen Limits an event’s message text to the specified length. No 100

Collection Frequency

Eventlogs can only be queried on a configurable schedule.

Schedule

To schedule the log collection, create a new [EventLog] stanza with a unique name and valid predicate as a first step for example:

Example 1

Filters log entries to forward only those created by the process named Finder. Use this to troubleshoot or monitor activity specific to the Finder process.

[EventLog Name=TimerBased-Messages]
Predicate = process == "Finder"
<!--NeedCopy-->
Example 2

Filters log entries to forward only those with a message type of error. Use this to quickly identify and investigate error events in the logs.

[EventLog Name=TimerBased-Messages]
Predicate = messageType == error
<!--NeedCopy-->
Example 3

Filters log entries to forward only those generated by the Finder process where the message type is info or the event message starts with ThumbnailCache. Use this to monitor Finder’s informational events and track thumbnail cache operations for troubleshooting or analysis.

[EventLog Name=TimerBased-Messages]
Predicate = process == "Finder" AND (messageType == info OR eventMessage BEGINSWITH "ThumbnailCache")
<!--NeedCopy-->

For a comprehensive list of available predicates and comparison operators, refer to the log tool’s manual page by running man log. For a more detailed overview, including documentation for wild card usage, you may also execute log help predicates.

NOTE: To forward log messages where messageType == debug or logType == debug, you must set the system-wide log level to debug using the following command:

sudo log config --mode level:debug

Please note that this setting will automatically revert to INFO after a system restart, due to performance considerations and the high volume of debug messages. To maintain this configuration across reboots, consider using a startup script or a launch daemon.

The second step involves creating a new timer and referencing the name of the Eventlog stanza.

[Timer]
Name = System Eventlog collection
EventLog = TimerBased-Messages
Interval = 60000
<!--NeedCopy-->

Default Configuration

uberAgent does not collect any logs by default. Event log collection needs to be enabled by an administrator. However, the infrastructure is already prepared. uberAgent comes with the files uberAgent-ESA-eventlog-windows.conf and uberAgent-ESA-eventlog-macOS.conf, which hold a few, platform specific, examples that can be activated by uncommenting the lines.

Metadata

Sourcetype

  • Windows Eventlog events are sent with the sourcetype uberAgentESA:System:WinEvtLogForwarding

  • macOS Eventlog events are sent with the sourcetype uberAgentESA:System:MacOsSystemLogForwarding

See the documentation for details.

Visualization

The collected Eventlogs are visualized on the Windows Eventlogs and macOS System Logs dashboards in the uberAgent ESA Splunk app. Below is a sample overview of Windows events. The macOS dashboard offers equivalent functionality while delivering macOS-specific information.

Windows Eventlogs dashboard overview

While the first charts give an overview of the collected Eventlogs, the data table at the bottom lists all of them grouped by channel, provider, ID, and level. Click a row in the table and a new chart with all details opens below. You can use the provided filter panels to limit the output to specific hosts, users, or process IDs.

Windows Eventlogs dashboard overview

Event Log Forwarding
December 11, 2025
Contributed by: 
C
December 11, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.