ACS Forwarder

An ACS Forwarder in an optional component of a SCOM architecture. It is part of the Audit Collection Services feature and used to collect Windows Security Log events and forward them to a Management Server hosting an ACS Collector component.

An ACS forwarder can be configured to only send specific security events by setting up filters. Doing so greatly reduce the volume of data sent and stored in the ACS Database. Considering the database can easily reach a few terabytes for only a few weeks retention period, this strategy helps to keep its size manageable.