> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Windows Event Log Integration
> Forward Syteca Windows Client log messages - errors, warnings, informational events - to the Windows Event Log for centralized log collection by SIEM agents or log management tools.
The **Windows Event Log integration** parameter forwards Syteca Client log messages - errors, warnings, informational events - to the Windows Event Log on the Client computer. Useful for environments where SIEM agents or log management tools already collect Windows Event Logs and you want Syteca operational events to flow through that pipeline.
**Applies to**: Windows Clients only. macOS and Linux Clients log to their native OS log facilities (Apple System Log, syslog, journald) but don't have an explicit integration parameter - those facilities are read directly by appropriate log collectors.
## Where to find it
The **Send log messages to Windows Event log** checkbox lives on the **Editing Client** / **Editing Client Group** page, on the **Properties** tab, in the **Windows Event log integration** section.
## Configuring the log level
When enabled, the **Log Level** drop-down list selects the severity level cutoff - only messages at or above this level are written to the Windows Event Log.
| Log Level | What's forwarded |
| ----------------------------------- | ----------------------------------------------------------------------- |
| **Error** *(default)* | Errors only |
| **Warning** | Warnings and errors |
| **Information** | Informational messages, warnings, errors - everything operational |
| *(other levels per Syteca version)* | Verbose / Debug categories may be available depending on Client version |
The default **Error** level is the conservative choice - only significant operational problems get forwarded, minimizing noise in your central log collection.
## What forwarded messages look like
Forwarded entries appear in the Windows Event Log with the **EkranSystem** source (or equivalent - the legacy `EkranSystem` source name is preserved in current Syteca versions for backward compatibility with existing log filters).
Common SIEM tools (Splunk Universal Forwarder, Microsoft Sentinel agent, IBM QRadar WinCollect, Elastic Beats) pick up the events alongside other Windows Event Log entries without additional configuration once the Client integration is enabled.
## Related
Direct Syteca-to-SIEM integration that bypasses the Event Log entirely.
The Syteca administrative audit log (separate from operational Client events).
Full Windows Client documentation.
Email-based notifications for Client-health issues - complementary to log-based monitoring.