Ask questions. Get answers. Find technical product solutions from passionate experts in the NXLog community.
Fail to delete duplicate with pm_norepeat
CharlesCharles created
Hello,
I'm trying to avoid having duplicate logs send to my OSSIM server. I tried using the pm_norepeat module but to no avail.
Here the line I added in nxlog.conf file :
<Processor sans_doublons>
Module pm_norepeat
</Processor>
<Route route_windows_logs>
Path in_windows_events => sans_doublons => out_alienvault_csv
</Route>
I also tried adding "CheckFields raw_event" in the processor, but I still get duplicate logs.
Does anyone know what could be the problem ?
Thanks
CharlesCharles created
