I spent a some time configuring the Eventlog-to-Syslog service on my domain controllers, yesterday. A bunch of that time was spent trying to figure out why the service wasnâ€™t able to read the config file I had created.
The upshot is that I had installed a 32-bit version of my text editor of choice. When I created the config file in c:\windows\System32 using 32-bit Vim, the WoW64 file system redirector on Server 2008 R2 was transparently relocating that file to c:\windows\SysWOW64. Then, when I tried to start the service, it failed to find or load the config file because it didnâ€™t exist in the correct location.