Making sure that conf file will send all logs to graylog
Hello,
I am rather new to nxlog and really enjoy the product so far. My question is, I want to ensure that ALL Windows Events on a server are being sent to my graylog server and that no logs are being omitted. This appears to be the default conf and it should work this way, but I am just being extra sure. Thanks very much in advance.
## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
#<Extension _syslog>
# Module xm_syslog
#</Extension>
<Extension gelf>
Module xm_gelf
</Extension>
<Input in>
Module im_msvistalog
# For windows 2003 and earlier use the following:
# Module im_mseventlog
</Input>
<Output out>
Module om_udp
Host 192.168.1.71
Port 12201
OutputType GELF
# Exec to_syslog_snare();
</Output>
<Route 1>
Path in => out
</Route>
This should collect all sources from your Windows Eventlog.