If you haven’t purchased Perch logging or to get a link to download the Perch Log Shipper for Windows, please reach out to your sales representative.

Supported OS versions - Windows 7 or Server 2012 R2 or greater

What's included in the Perch Log Shipper?

  1. Winlogbeats - Winlogbeats sends your Windows Event Logs to the Perch sensor for processing and storage.
  2. Sysmon - Sysmon is a free utility provided my Microsoft Sysinternals groups that provides a higher fidelity of insight in how your Windows systems are operating.

Installing Perch Log Shipper

  1. Locate and execute the downloaded installer

  2. Choose Next>

  3. Enter the IP address of your Perch sensor, this is required for this to function correctly and choose Install

  4. Click Finish to complete the setup

Command Line Options

The Perch Log Shipper for Windows includes simple command line options to deploy the Log Shipper silently and set the IP address.


perch-log-shipper-latest.exe /S /SENSORIP=

Will install the Perch Log Shipper silently and set a Sensor IP address of

Installer notes

If there is a host-based firewall, network firewall or network ACL between the endpoint and the Perch sensor, TCP/5044 will need to be allowed to traverse from the endpoint to the Perch sensor.

The installer writes data to C:\Program Files\Perch (or C:\Program Files (x86), for x86 based systems), C:\ProgramData\winlogbeat and creates two services - perch-winlogbeat and sysmon.