I spent a some time configuring the Eventlog-to-Syslog service on my domain controllers, yesterday. A bunch of that time was spent trying to figure out why the service wasn’t able to read the config file I had created.
The upshot is that I had installed a 32-bit version of my text editor of choice. When I created the config file in c:windowsSystem32 using 32-bit Vim, the WoW64 file system redirector on Server 2008 R2 was transparently relocating that file to c:windowsSysWOW64. Then, when I tried to start the service, it failed to find or load the config file because it didn’t exist in the correct location.