# Why Graylog does not collect some logs from Windows Servers?

**URL:** <https://community.graylog.org/t/why-graylog-does-not-collect-some-logs-from-windows-servers/35932>\
**Category:** Graylog Central (peer support)\
**Tags:** windows, nxlog, gelf\
**Created:** [July 2, 2025, 2:55pm UTC](https://community.graylog.org/t/why-graylog-does-not-collect-some-logs-from-windows-servers/35932 "2025-07-02T14:55:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alesblinka](https://avatars.discourse-cdn.com/v4/letter/a/bbce88/32.png) [@alesblinka](https://community.graylog.org/u/alesblinka)\
**Post date:** [July 2, 2025, 2:55pm UTC](https://community.graylog.org/t/why-graylog-does-not-collect-some-logs-from-windows-servers/35932/1 "2025-07-02T14:55:05Z")

</div>

Hi

I use Graylog pretty well, it collects logs from my Linux even Windows servers. But I have found it does not collect everything from Windows. E.g. I can see all failure even successful logons are collected. Even new created and deleted account in Active Directory. But changes in groups are not collected event if I can see them in Eventviewer of Domain controller. I started to collect data from Enterprise Certification Authority. I can see that all is collected from Security channel. But not EventID 4872 - crl publishing. How can I troubleshoot it?

My Graylog runs on Ubuntu server 22 in Docker container  
Package Version: 6.1.5

I use NXlog clients on my Windows server. I checked nxlog.conf and there is no filtering that would drop any messages on clients side  
I set only filtering name of my server = source:servername and than I searched my lost Event IDs manually without success  
My stream rules are very simple = source contain nameofserver. There is no special filtering  
I dont have any piplane that woud drop any message regarding Windows servers

Can you tell me what to check more in Graylog? Or must do I have anything special with my Windows server to get all logs?

Thank you, Aldomoro

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 16, 2025, 2:55pm UTC](https://community.graylog.org/t/why-graylog-does-not-collect-some-logs-from-windows-servers/35932/2 "2025-07-16T14:55:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.