Only sending "Forwarded Events" logs | Log collection solutions

#1 dsw283 6 years ago

In my configuration file I have an entry that looks as such:

<Input eventlog>
     Query <QueryList>\
               <Query Id="0">\
                   #<Select Path="Application"></Select>\
                   #<Select Path="Security"></Select>\
                   #<Select Path="Setup"></Select>\
                   #<Select Path="System"></Select>\
                   <Select Path="Forwarded Events">*</Select>\
               </Query>\
           </QueryList>
</Input>

When I start NXlog, I get all logs (Application, Security, Setup, etc...) How do only allow the "Forwarded Events" logs?

Permalink

#2 b0ti Nxlog ✓ 6 years ago

#1 dsw283

In my configuration file I have an entry that looks as such: <Input eventlog> Query <QueryList>\ <Query Id="0">\ #<Select Path="Application"></Select>\ #<Select Path="Security"></Select>\ #<Select Path="Setup"></Select>\ #<Select Path="System"></Select>\ <Select Path="Forwarded Events">*</Select>\ </Query>\ </QueryList> </Input> When I start NXlog, I get all logs (Application, Security, Setup, etc...) How do only allow the "Forwarded Events" logs?

You can't use # to comment out inside the XML. That's probably giving a subscription error, check nxlog.log.