Create Log Distribution Service Policies

 To create a Log Distribution Service policy:

1. On the main toolbar, click Deployment Manager.
2. On the Tools menu, click Distribution, click Log Distribution Services, and then click Policy Manager.
   The Log Distribution Policy window appears.
3. On the File menu, click New.
   The Log Distribution Policy Wizard appears.
4. Select the log sources from which you want to gather messages.
   For more information on selecting sources and creating filters, see Filters and Wizards.
5. Click Next.
6. Select an Event Distribution Criteria:
   1. Include events that meet the include/exclude filters below. Exclude all non-events. Distribute only events that match the filters below and none of the non-events.
   2. Include events regardless of the include/exclude criteria below. Include any non-events that meet the include/exclude criteria below. Distribute all events and any non-events that match the filters below.
   If you do not select an option, all event and non-event log messages that match the filters are distributed.

7. To specify Include and Exclude filters, click New.
   The Log Message Filter window appears. For more information on how to use this option, see Filters and Wizards.

   

   Include Filters distribute log messages that match at least one filter and do not match an exclude filter.

   • If a log message matches any exclude filters, it is not distributed.
   • If you do not create any filters, all events and non-events that fulfill the Event Distribution Criteria are distributed.
8. Click Next.

9. Select the Action check box of all the Distribution Receivers to which you want log messages to be distributed.

   

   You must Enable a Log Distribution Receiver before it can receive logs.

10. Click Next.
11. To use a syslog sender override:
    1. Select its Override box.
    2. Enter the new Outbound IP Address and Outbound Port.
12. Click Next.
13. Type a descriptive Policy Name.
14. Type a Policy Description.
15. Click OK.
    You return to the Log Distribution Policy Manager window.
    The new policy is selected and the Status is Disabled.
16. To enable the new policy immediately, right-click it, and then click Enable.