title: Windows Event Collector Load Balancing to multiple Collectors
body: <p><strong>My scenario:</strong></p>
  
  <p>I want several Windows servers to forward Events either to Collector A or to Collector B and so on.</p>
  
  <p><strong>What I tried:</strong></p>
  
  <p>Set the GPO:
  Computer Settings - Policies- Administrative Templates - Windows Components - Event Forwarding - Configure target Subscription Manager</p>
  
  <pre><code>Server=http://Collectors.contoso.com:5985/wsman/SubscriptionManager/WEC
  </code></pre>
  
  <p>where Collectors is the name of the Cluster (set up via NLB), where Collector A and B are members of.</p>
  
  <p><strong>The Problem:</strong> no events have been forwarded.</p>
  
  <p>How does the Event-Forwaring actually work?
  Is it possible and useful to use Network Load Balancing (NLB)?</p>
  
  <p><em>Notes:</em>
  Im using WinServ 2012R2 and all Firewalls have been disabled.</p>
  
  <p>My Subscription von Collector A and B:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription"&gt;
      &lt;SubscriptionId&gt;pull1&lt;/SubscriptionId&gt;
      &lt;SubscriptionType&gt;SourceInitiated&lt;/SubscriptionType&gt;
      &lt;Description&gt;&lt;/Description&gt;
      &lt;Enabled&gt;true&lt;/Enabled&gt;
      &lt;Uri&gt;http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog&lt;/Uri&gt;
      &lt;ConfigurationMode&gt;Normal&lt;/ConfigurationMode&gt;
      &lt;Delivery Mode="Push"&gt;
          &lt;Batching&gt;
              &lt;MaxLatencyTime&gt;900000&lt;/MaxLatencyTime&gt;
          &lt;/Batching&gt;
          &lt;PushSettings&gt;
              &lt;Heartbeat Interval="900000"/&gt;
          &lt;/PushSettings&gt;
      &lt;/Delivery&gt;
      &lt;Query&gt;
          &lt;![CDATA[
  &lt;QueryList&gt;&lt;Query Id="0"&gt;&lt;Select Path="Application"&gt;*&lt;/Select&gt;&lt;Select Path="Security"&gt;*&lt;/Select&gt;&lt;Select Path="Setup"&gt;*&lt;/Select&gt;&lt;Select Path="System"&gt;*&lt;/Select&gt;&lt;Select Path="ForwardedEvents"&gt;*&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;
          ]]&gt;
      &lt;/Query&gt;
      &lt;ReadExistingEvents&gt;false&lt;/ReadExistingEvents&gt;
      &lt;TransportName&gt;HTTP&lt;/TransportName&gt;
      &lt;ContentFormat&gt;RenderedText&lt;/ContentFormat&gt;
      &lt;Locale Language="en-US"/&gt;
      &lt;LogFile&gt;ForwardedEvents&lt;/LogFile&gt;
      &lt;PublisherName&gt;Microsoft-Windows-EventCollector&lt;/PublisherName&gt;
      &lt;AllowedSourceNonDomainComputers&gt;
          &lt;AllowedIssuerCAList&gt;
          &lt;/AllowedIssuerCAList&gt;
      &lt;/AllowedSourceNonDomainComputers&gt;
      &lt;AllowedSourceDomainComputers&gt;O:NSG:BAD:P(A;;GA;;;DC)S:&lt;/AllowedSourceDomainComputers&gt;
  &lt;/Subscription&gt;
  </code></pre>
  
  <p>Thanks</p>