Using NXlog to send application logs from multiple files within a folder to RSA

Tags:

#1 anusha_rampure

Hi All,

We have configured Nxlog to send application logs to RSA Virtual log collector.

We are able to send one logfile using the below configurations in nxlog.conf

<Input AppLogs> Module im_file File 'C:\Important_Application\Logs\log1.log' SavePos FALSE Recursive TRUE ReadFromLast FALSE Exec $Message = $raw_event; </Input>

<Output out2> Module om_tcp Host "0.0.0.0" Port 514 </Output>

<Route 2> Path AppLogs => out2 </Route>

However, we are unable to send all the log files within the Logs directory.

We tried the below methods:

<Input AppLogs> Module im_file File 'C:\Important_Application\Logs*.log' or 'C:\Important_Application\Logs*.log' or 'C:\Important_Application\Logs' or 'C:\Important_Application\Logs*' SavePos FALSE Recursive TRUE ReadFromLast FALSE Exec $Message = $raw_event; </Input>

But none of the above methods are workings. We need to send all the log files within the "Logs" folder.

Please help.

#2 jeffron Nxlog ✓
#1 anusha_rampure
Hi All, We have configured Nxlog to send application logs to RSA Virtual log collector. We are able to send one logfile using the below configurations in nxlog.conf <Input AppLogs> Module im_file File 'C:\Important_Application\Logs\log1.log' SavePos FALSE Recursive TRUE ReadFromLast FALSE Exec $Message = $raw_event; </Input> <Output out2> Module om_tcp Host "0.0.0.0" Port 514 </Output> <Route 2> Path AppLogs => out2 </Route> However, we are unable to send all the log files within the Logs directory. We tried the below methods: <Input AppLogs> Module im_file File 'C:\Important_Application\Logs*.log' or 'C:\Important_Application\Logs*.log' or 'C:\Important_Application\Logs' or 'C:\Important_Application\Logs*' SavePos FALSE Recursive TRUE ReadFromLast FALSE Exec $Message = $raw_event; </Input> But none of the above methods are workings. We need to send all the log files within the "Logs" folder. Please help.

Hi Anusha,

It appears you are not using the wildcards correctly. you should probably use this

File "C:\\Important_Application\\Logs\\*"

I hope this helps.

Regards,

Jeffron