Trying to get this to work on a Windows 2019 Server that's a clean build with nothing on it and has all current Windows updates applied
Is it an issue with Windows 2019 Server or an issue with the XM_SYSLOG module?

######### WORKING - Copies event log data to C:\Program Files\nxlog\data\nxlog-output.log ########
define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
Module xm_syslog
</Extension>

# Monitor Windows event logs
<Input eventlog>
Module im_msvistalog
</Input>

<Output file>
Module om_file
File 'C:\Program Files\nxlog\data\nxlog-output.log'
Exec to_syslog_snare();
</Output>

<Output syslogout>
Module om_ssl
Host logsx.papertrailapp.com
Port 12345
Exec $Hostname = hostname(); to_syslog_ietf();
OutputType Syslog_TLS
CAFile %CERTDIR%/papertrail-bundle.pem
AllowUntrusted FALSE
</Output>

<Route out>
Path eventlog => file
</Route>

######### NOT WORKING - NXLOG Service will start for a moment and then stop immediately ###########
<Route out>
Path eventlog => syslogout
</Route>


nxlog.log
2022-03-16 18:10:47 WARNING not starting unused module file
2022-03-16 18:10:47 INFO nxlog-ce-3.0.2272 started
2022-03-16 18:10:47 INFO connecting to logs3.papertrailapp.com:49305
2022-03-16 18:10:47 INFO successfully connected to logx.papertrailapp.com:12345

Windows Logs, Application Events:
Source: Application Error
Event ID: 1000
Faulting application name: nxlog.exe, version: 0.0.0.0, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 10.0.17763.2628, time stamp: 0x91ea188a
Exception code: 0xc0000374
Fault offset: 0x00000000000faad9
Faulting process id: 0xa7c
Faulting application start time: 0x01d8399bfa79f8d0
Faulting application path: C:\Program Files\nxlog\nxlog.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 7870365a-2a26-49dd-9670-7c8d889f9dda
Faulting package full name:
Faulting package-relative application ID:

Windows Logs, Application Events:
Source: Windows Error Reporting
Event ID: 1001
Fault bucket 1367701673690831831, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: nxlog.exe
P2: 0.0.0.0
P3: 00000000
P4: StackHash_2e07
P5: 10.0.17763.2628
P6: 91ea188a
P7: c0000374
P8: PCH_43_FROM_ntdll+0x00000000000A0544
P9:
P10:

Attached files:
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER86A8.tmp.dmp
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER87D2.tmp.WERInternalMetadata.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8802.tmp.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8804.tmp.csv
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8843.tmp.txt

These files may be available here:
\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_nxlog.exe_7198d2d4b17dc7d6aaa419f8df82eecf4ad86a_e5992931_12418b0d

Analysis symbol:
Rechecking for solution: 0
Report Id: 7870365a-2a26-49dd-9670-7c8d889f9dda
Report Status: 268435456
Hashed bucket: 8cc762824f1e456172fb0d6d030c9bd7
Cab Guid: 0