The Faddom Event Log Forwarder is a Windows service that can be deployed on your Active Directory servers to forward user login and DNS events directly to Faddom in real time. It communicates over encrypted UDP, removing the need for WMI polling or a standalone Windows proxy for User Discovery.
Note: This feature requires a Windows-based Active Directory server with .NET Framework 4.7.2 or later. Port 9544 UDP must be open from the AD server to the Faddom server or proxy.
Prerequisites
Before installing the service, make sure you have the following:
A Windows-based Active Directory server
.NET Framework 4.7.2 or later
Port 9544 UDP open from the AD server to the Faddom server or proxy
Get your authentication key
Before installing, retrieve the Proxy Authentication Key from Faddom.
Step by step:
In Faddom, go to Settings and select Proxy Configuration.
Select Add Proxy.
Under "Proxy Authentication Key", select Copy.
Install the service
Follow the steps below to download and install the Faddom Event Log Forwarder.
Step by step:
In Faddom, go to Settings and select User Discovery.
Select the Event Log Forwarder link to download the installer.
Run the EventLogForwarderSetup installer on your Active Directory server and follow the on-screen instructions. The installer automatically configures most parameters.
Once installed, the Faddom Event Log Forwarder Service starts automatically.
Tip: For best results, install the service on every Active Directory server in your environment.
Advanced configuration
The installer handles most configuration automatically. If you need to make changes after installation, you can edit the config file located at:
C:\Program Files\Faddom\Event Log Forwarder\EventLogForwarder.exe.config
xml
<appSettings> <add key="faddomProxyAddress" value="10.0.0.10"/> <add key="destinationPort" value="9544"/> <add key="proxyAuthenticationKey" value="your_authentication_key"/> <add key="enableLoginEventParser" value="true"/> <add key="enableDnsEventParser" value="true"/> <add key="samplingRate" value="1"/> </appSettings>
faddomProxyAddress - the IP address of your Faddom server or standalone proxy
destinationPort - the port used to send events to Faddom. Default is 9544
proxyAuthenticationKey - the authentication key copied from Faddom's Proxy Configuration screen
enableLoginEventParser - set to
trueto forward user login eventsenableDnsEventParser - set to
trueto forward DNS eventssamplingRate - controls the proportion of events forwarded. A value of
1forwards 100% of events. A value of10forwards 1 in every 10 events (10%)
Note: Restart the Faddom Event Log Forwarder Service after making any changes to the config file.