Hello,

It seems that there is some kind of conflict or bug in nxlog-ce-2.8.1248 (I'm not sure about earlier versions) where, upon boot, nxlog gets stuck in a loop initiating connections to a remote machine (Logstash in my case using om_tcp).

I only became aware of this after installing nxlog on server that had the group policy "Audit Filtering Platform Connection" enabled on successful connections; this actually generated so many events that it filled up my elasticsearch cluster (I've attached a sample of the event the filled the cluster).

The issue doesn't happen when nxlog service is configured for "Automatic (Delayed Start)".

I hope this helps.

Thanks