About the movement when I enable event forwarding.
I have a plan to introduce Symantec security information manager.
A role of the server-A is Correlation.
A role of the server-B is Archiving and Collector.
I will forward the event from server-B to server-A.
I want to know about the movement of logging when you enable event forwarding.
when I enable event forwarding,
1. The log is forwarded. Later than the log when you enable.
2. The log is forwarded. Including log earlier than when you have enabled.
Which do you move?
Please tell me.