Events are collected or sent (when subscription configuration is set to normal) every 15 minutes which is quite adequate for normal operations; however, there might be critical periods for some resources that we need to reduce this delay and get critical events faster. As already noted in Setting up an Event Collecting Computer, with the help of the wecutil command-line tool we can modify this parameter. The wecutil syntax is as follows:
wecutil ss "subscription_name" /cm:custom
wecutil ss "subscription_name" /hi:<milliseconds_delay>
where the only parameters you need to specify are the subscription name and the delay in milliseconds, for example:
wecutil ss "Test Subscription" /cm:custom
wecutil ss "Test Subscription" /hi:30000
would set our current subscription called "Test Subscription" to 5 minutes intervals. The interval parameter is called HeartbeatInterval as shown below:
To display the current configuration, at an elevated command prompt type:
wecutil gs "Test Subscription"
For a full list of the wecutil command options type wecutil /? at the command prompt.
