I'm using the test feature on the Log Forwarder. I see all of the other configured log entries reaching the server but not the Windows failed login entries.
I've created the new filter using the text snippet and an email alert, no luck, though.
The domain controllers are operating @ 2012 R2, I'll modify the filter to look for 4625.
Thanks for the advice, much appreciated.