<![CDATA[Windows Forwarded Event Source]]>I have a windows event collector server and I want to get the forwarded events from that server. The difference is that there is a column named computer which holds the originator pc of that event. However in event viewer I cannot see that info as source. I see the windows event collector server as source (as expected).

Is there a way to set that computer field (I can get the value using %<number>) as source. Or I have to create duplicate events for forwarded events and put computer info in event string.

]]>https://forum.netxms.org/topic/6249/windows-forwarded-event-sourceRSS for NodeFri, 13 Nov 2026 12:51:35 GMTThu, 31 Oct 2019 09:24:58 GMT60<![CDATA[Reply to Windows Forwarded Event Source on Mon, 04 Nov 2019 09:20:14 GMT]]>Another option to avoid storing double events is to remove "write to event log" option from original event.

Best regards,
Victor

]]>https://forum.netxms.org/post/26867https://forum.netxms.org/post/26867Mon, 04 Nov 2019 09:20:14 GMT<![CDATA[Reply to Windows Forwarded Event Source on Tue, 05 Nov 2019 10:20:57 GMT]]>I don't think you can change an event source after that event is received.
As you indicated, you can create a new event and set the correct source for that new event though.
To avoid your database doubling in size, you could run a regular cronjob/scheduled task to clean out the duplicates.

Or you could use a cronjob/scheduled task to adjust the source directly inside the database at regular intervals. That wouldn't be live though.
Or setup a trigger in the database to automatically perform that task in certain cases. Not sure about the performance impact on such a step though.

Edit: Or simply use the inbuilt and smart way of doing it, which Victor mentioned below.  :-[

]]>https://forum.netxms.org/post/26855https://forum.netxms.org/post/26855Tue, 05 Nov 2019 10:20:57 GMT