Well in one scenario we have secure environments with multiple workstations and a local server. Only the server has a direct connection to the syslog server. I have the local server subscribed to events from the workstations and I would like to have Event Log Forwarder (installed on the local server) forward the aggregated events to the syslog server.
For other servers, I would like to have a single Windows server collecting events from other servers and forward all collected/subscribed events to the syslog server. This way we could setup one server with Event Log Forwarder (connected to the syslog server) and use group policy to push events from other servers.
Sorry if that still isn't quite clear.
Thank you,
Jeremy