I have SW LF4W installed on 3 2008R2 systems. all 3 are DC's, I get log messages for successful account log ons from only one of the DC's in my kiwisyslog. I have confirmed via the servers that they are all logging successful login's on their own but 2 of them are not sending the info to the syslog. I have confimred that the LF4W is configured exactly that same on each of the DC's and I get other messages from all 3 just not all the login's. My biggest issue I get ZERO account locked out messages from any of the DC's
Here is my general config for the LF4W
New Even Log Subscription
I have the following checked
Applicaion
Directory Service
HardwareEvents
Security
System
on the right side I have
Error / Warning / Inforamation all checked
Event Source is <All Event Sources>
Task Category is Enumerating Task Categories
On the Please Specify the default syslog priority for this subscription page
Default syslog facility : Kernal (messages)