EventCollector Subscription
- My goal is forward events from my XP and 2003 R2 clients to a 2008 server.
I have installed WINRM on the clients and ran quickconfig and I have created two different subscriptions on the 2008 server; source initiated and collector initiated. I did not get far with the source initiated subscription because I do not know how to configure the GPO value of SubscriptionManagers on my clients (per http://msdn.microsoft.com/en-us/library/bb870973(VS.85).aspx).
I did get further with my collector initiated subscription however. After defining a couple of clients I used the default Machine Account security. This failed with access denied. Then I switched the account to a domain admin account over HTTP. The runtime status returns the following error:
The connectivity test from the push subscription source to the client failed. This can happen if the client machine initiating the push subscription is unreachable from the server machine where the event source is located. Possible reasons include firewall or some other network boundary. Modify subscription to use Pull based subscription.
Digging in HTTP with wireshark the conversation fails with HTTP 401 error on the server side after the client issues a POST /wsman/subscriptions/<guid> command. Auth on both client and server winrm service is set to Basic,Kerb,Negotiate.
Any input would be appreciated...
Chris
Answers
- See XP<>2008 Collector Initiated solution:
http://sync-io.net:83/2008/06/18/SubscribingHTTPXP2003ClientsToTheEventCollectorPost1.aspx
Please add your comments to the above blog.- Marked As Answer byfixitchris Wednesday, June 18, 2008 4:49 PM
All Replies
- fixitchris said:
My goal is forward events from my XP and 2003 R2 clients to a 2008 server.
As far as I know Windows XP and Windows Server 2003 do not offer Event Forwarding or Event Subscriptions.
More info here. - Why do you say that?
WinRM can be installed on both platforms (http://www.microsoft.com/technet/scriptcenter/newswire/winrm.mspx). And there is a wsman conversation going on between XP client and 2008 server, except the failure is somewhere in the authentication.
I did read somewhere that server 2003 does not support Kerberos in the scheme of EventCollector... I wish I could find this article again. (related: http://support.microsoft.com/kb/912030)- Edited byfixitchris Wednesday, June 18, 2008 1:45 PMedit
- Marked As Answer byfixitchris Wednesday, June 18, 2008 1:50 PM
- Edited byfixitchris Wednesday, June 18, 2008 1:51 PMedit
- Edited byfixitchris Wednesday, June 18, 2008 2:01 PMedit
- Unmarked As Answer byfixitchris Wednesday, June 18, 2008 2:02 PM
- See XP<>2008 Collector Initiated solution:
http://sync-io.net:83/2008/06/18/SubscribingHTTPXP2003ClientsToTheEventCollectorPost1.aspx
Please add your comments to the above blog.- Marked As Answer byfixitchris Wednesday, June 18, 2008 4:49 PM
