Forwarded is the good state. It means the message passed all of the filters and was handed over to the SyslogAnalyzer for insertion into the RME database. Invalid messages are those which are not properly formatted Cisco syslog messages. A high invalid count is expected on Windows as Daemon Manager writes its messages to the same syslog.log, and those are not valid Cisco syslog messages.