# Windows Event Forwarding

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Windows  |         | ✓    |        |

### **Configuration Table**

<table><thead><tr><th width="208.046875">Parameter</th><th width="87.4140625">Type</th><th width="95.7578125">Default</th><th>Description</th></tr></thead><tbody><tr><td>start_at</td><td>enum</td><td>end</td><td>Start reading logs from <code>beginning</code> or <code>end</code>.</td></tr><tr><td>collection_mode</td><td>enum</td><td>Streaming</td><td>Collection mode to use. When set to <code>Streaming</code>, the source streams events as they arrive. When set to <code>Polling</code>, the source polls for new events at a fixed interval.</td></tr><tr><td>polling_interval</td><td>float</td><td>5</td><td>The interval (seconds) at which the channel is checked for new log entries.</td></tr><tr><td>wait_timeout</td><td>float</td><td>5</td><td>Maximum duration (seconds) to wait for new events before performing a safety-net poll.</td></tr><tr><td>resolve_sids.enabled</td><td>bool</td><td>false</td><td>Enable Security Identifier (SID) resolution. When enabled, SID values in event logs (e.g., S-1-5-18) are resolved to human-readable account names (e.g., NT AUTHORITY\SYSTEM). For more information, see<a data-mention href="#sid-resolution">#sid-resolution</a>.</td></tr><tr><td>resolve_sids.cache_size</td><td>uint</td><td>10000</td><td>Maximum number of resolved SIDs to cache. Increase for environments with many unique accounts.</td></tr><tr><td>resolve_sids.cache_ttl</td><td>duration</td><td>15m</td><td>How long resolved SID entries are cached before re-lookup. Lower values detect account changes faster; higher values reduce API calls.</td></tr><tr><td>raw_logs</td><td>bool</td><td>true</td><td>When enabled, the XML log is not parsed into a structure but instead saved to the log body.</td></tr><tr><td>event_data_format</td><td>enum</td><td>map</td><td>Sets the format used to express Event Data in the parsed log body. Options are 'map' or 'array'. Only exposed if <code>raw_logs</code> is false.</td></tr><tr><td>suppress_rendering_info</td><td>bool</td><td>true</td><td>When this is enabled, the source will not attempt to resolve rendering info. This can improve performance but comes at a cost of losing some details in the event log.</td></tr><tr><td>include_log_record_original</td><td>bool</td><td>true</td><td>When enabled, the original log record is included in the log body.</td></tr><tr><td>ignore_channel_errors</td><td>bool</td><td>true</td><td>When enabled, prevents shutdown of collector when failing to open channels, and instead logs a warning.</td></tr><tr><td>enable_file_offset_storage</td><td>bool</td><td>true</td><td>When enabled, the current position in the Windows Events will be saved to disk, and reading will resume from where it left off after a collector restart.</td></tr><tr><td>offset_storage_directory</td><td>string</td><td>${OIQ_OTEL_COLLECTOR_HOME}/storage</td><td>The directory that the offset storage file will be created in.</td></tr><tr><td>enable_retry_on_failure</td><td>bool</td><td>true</td><td>Attempt to resend telemetry data that has failed to be transmitted to the destination.</td></tr><tr><td>retry_on_failure_initial_interval</td><td>int</td><td>1</td><td>Time (in seconds) to wait after the first failure before retrying.</td></tr><tr><td>retry_on_failure_max_interval</td><td>int</td><td>30</td><td>The upper bound (in seconds) on backoff.</td></tr><tr><td>retry_on_failure_max_elapsed_time</td><td>int</td><td>300</td><td>The maximum amount of time (in seconds) spent trying to send a batch, used to avoid a never-ending retry loop.</td></tr></tbody></table>

#### SID Resolution

When SID resolution is enabled, the following Event data fields are added to log records (added alongside any field ending in Sid, such as SubjectUserSid or TargetUserSid):

* {FieldName}\_Resolved - Fully qualified name (e.g., NT AUTHORITY\SYSTEM)
* {FieldName}\_Domain - Domain name
* {FieldName}\_Account - Account name
* {FieldName}\_Type - Account type

Common well-known SIDs (such as SYSTEM, BUILTIN\Administrators, LOCAL SERVICE, etc.) are resolved locally without requiring network calls. All other SIDs are resolved via the Windows LSA API, which automatically contacts the domain controller for domain-joined machines.

If a SID cannot be resolved (invalid format, lookup failure), the original SID value is preserved, and processing continues normally. No events are dropped.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/integrations/sources/windows-event-forwarding.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.