Config works without <QueryXML> lines. When i add thoose lines it stops sends any data. I tested with user modification or login fail etc.

Thanks for your help

<Extension syslog> Module xm_syslog </Extension>

<Extension xml> Module xm_xml </Extension>

<Input eventlog> Module im_msvistalog <QueryXML> <QueryList> <Query Id="0"> <Select Path="Security">*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0) and (EventID=1102 or EventID=4719 or EventID=4704 or EventID=4717 or EventID=4738 or EventID=4798 or EventID=4705 or EventID=4674 or EventID=4697 or EventID=4648 or EventID=4723 or EventID=4946 or EventID=4950 or EventID=6416 or EventID=6424 or EventID=4732)]]</Select> </Query> </QueryList> </QueryXML> Exec $Message = to_xml(); to_syslog_bsd(); </Input>

<Output tcp> Module om_tcp Host 127.0.0.1 Port 514 </Output>

<Route eventlog_to_tcp> Path eventlog => tcp </Route>