MARS Support for Windows 2008 Server

Answered Question
Dec 15th, 2008

Does anyone have any experiences they could share regarding Win 2008 server and MARS 6.0.1?

I know it is not part of any drop down menus in MARS but am interested if we can go ahead and use the Win2003 drop down selection.


I have this problem too.
0 votes
Correct Answer by krir about 7 years 10 months ago

Hi Paul

You can configure the MARS to pull the events directly from the Windows 200x, you don't need to install SNARE to pull the events from MARS.

Please ref. the below URL for more detail on pulling the events from window

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
pmccubbin Mon, 12/15/2008 - 09:07

Hi Krishnan!

Many thanks for the answer.

The SNARE agent doesn't support Win 2008. What do you suggest for sending the logs to MARS? Are the Windows logs normalized enough for MARS to sessionize?


patwill66_2 Mon, 12/15/2008 - 10:05

I use an application made by Datagram called Syslog Agent that works really well. I actually prefer to over SNARE. Its easy to configure and has more options, such as export text log files and configuring via the registry. The link to download is I have used this on 2008 without any issues.

krir Mon, 12/15/2008 - 10:13


If windows 2008 can support the SNARE. I don't MARS have any issues normalizing it. I am not sure whether MARS parse(normalize) the events coming from windows 2008 which is coming from Agents other then SNARE.

However, if the format of event coming from the syslog Agent is same as SNARE agent, then it should parse it.




This Discussion