WEF forwarding delays during high log volume

3D IM 20 Reputation points
2026-07-13T16:44:58.9166667+00:00

We're trying to reduce long delays in our Windows Event Forwarding deployment.

Current setup: large-scale WEF environment, source-Initiated subscriptions, central collector cluster

But the problem is security events can take up to 45 minutes to reach the collectors during heavy logging periods.

We're looking for WinRM settings that affect forwarding frequency and recommended tuning to reduce propagation latency under sustained load. Thank you.

Windows for business | Windows 365 Enterprise
0 comments
Answer accepted by question author
Tracy Le 12,330 Reputation points Independent Advisor
2026-07-13T17:28:16.9066667+00:00

Hello 3D IM ,

A 45-minute delay in a massive WEF deployment usually happens because the default Max Throughput policy aggressively buffers logs to save bandwidth, which completely backfires under heavy sustained loads. To drop propagation latency to near real-time, you need to change your subscription delivery optimization to Minimize Latency using the wecutil command on your central collector cluster. Specifically, setting the maximum latency time down to 30000 milliseconds and lowering the maximum item count forces the source machines to constantly stream logs instead of hoarding them.

To make sure the source endpoints can keep up with this aggressive streaming without dropping sessions, you should also elevate the MaxMemoryPerShellMB value to 1024 inside your WSMAN registry configuration path. Shifting to this continuous streaming model will instantly clear out your event backlog and distribute the processing load evenly across your collector cluster. If these tuning adjustments successfully squash your log forwarding delays, please accept the answer so others with the same issue can find the solution. Feel free to leave a comment if you need further information.

Tracy Le.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.