"Thirdly, all of the events that are forwarded to the collector say that the description for Event ID blah cannot be found." I ran the command "wecutil ss <subscriptionname> /cf:events" to fix this issue on my test. As per "wecutil ss /h" the CF switch is for content format.By default it is set to RenderedText. After running the /cf:events command it will change the format to events. My setup was a collector based subscription from a 2008 R2 server to a win7 pro client.Hope this helps.
↧