An example of merging local and server-side configuration of the Log Insight Windows Agent.

You can have the following local configuration of the Log Insight Windows Agent.

[server]
proto=cfapi
hostname=HOST
port=9000

[winlog|Application]
channel=Application

[winlog|Security]
channel=Security

[winlog|System]
channel=System

[filelog|ApacheAccessLogs]
enabled=yes
directory=C:\Program Files (x86)\Apache Software Foundation\Apache2.2\logs 
include=*.log 
exclude=*_old.log 
event_marker=^(\d{1,3}\.){3}\d{1,3} - -

You can use the Administration > Agents page of the Web user interface to apply centralized configuration to all agents. For example, you can exclude and add collection channels, and change the default reconnect setting.

[server]
reconnect=20

[winlog|Security]
channel=Security
enabled=no

[winlog|Microsoft-Windows-DeviceSetupManagerOperational]
channel=Microsoft-Windows-DeviceSetupManager/Operational

The effective configuration is a result of the merging of the local and the server-side configurations. The Log Insight Windows Agent is configured to

reconnect to the Log Insight server every 20 minutes

continue to collect Application and System event channels

stop collecting Security event channel

start to collect Microsoft-Windows-DeviceSetupManager/Operational event channel

continue to collect ApacheAccessLogs

[server]
proto=cfapi
hostname=HOST
port=9000
reconnect=20

[winlog|Application]
channel=Application

[winlog|Security]
channel=Security
enabled=no

[winlog|System]
channel=System

[winlog|Microsoft-Windows-DeviceSetupManagerOperational]
channel=Microsoft-Windows-DeviceSetupManager/Operational

[filelog|ApacheAccessLogs]
enabled=yes
directory=C:\Program Files (x86)\Apache Software Foundation\Apache2.2\logs 
include=*.log 
exclude=*_old.log 
event_marker=^(\d{1,3}\.){3}\d{1,3} - -