Making sure that conf file will send all logs to graylog

Tags:

#1 Selmack

Hello,

I am rather new to nxlog and really enjoy the product so far.  My question is, I want to ensure that ALL Windows Events on a server are being sent to my graylog server and that no logs are being omitted.  This appears to be the default conf and it should work this way, but I am just being extra sure.  Thanks very much in advance.

 

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

#<Extension _syslog>
#    Module      xm_syslog
#</Extension>

<Extension gelf>
    Module      xm_gelf
</Extension>

<Input in>
    Module      im_msvistalog
# For windows 2003 and earlier use the following:
#   Module      im_mseventlog
</Input>

<Output out>
    Module      om_udp
    Host        192.168.1.71
    Port        12201
    OutputType  GELF
#   Exec        to_syslog_snare();
</Output>

<Route 1>
    Path        in => out
</Route>

#3 adm Nxlog ✓
#1 Selmack
Hello, I am rather new to nxlog and really enjoy the product so far.  My question is, I want to ensure that ALL Windows Events on a server are being sent to my graylog server and that no logs are being omitted.  This appears to be the default conf and it should work this way, but I am just being extra sure.  Thanks very much in advance.   ## This is a sample configuration file. See the nxlog reference manual about the ## configuration options. It should be installed locally and is also available ## online at http://nxlog.org/docs/ ## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log #<Extension _syslog> #    Module      xm_syslog #</Extension> <Extension gelf>     Module      xm_gelf </Extension> <Input in>     Module      im_msvistalog # For windows 2003 and earlier use the following: #   Module      im_mseventlog </Input> <Output out>     Module      om_udp     Host        192.168.1.71     Port        12201     OutputType  GELF #   Exec        to_syslog_snare(); </Output> <Route 1>     Path        in => out </Route>

This should collect all sources from your Windows Eventlog.