After a bit of trial and and lots of reading, I managed to get Graylog2 working like a charm


I'm using NXLOG to send the logs to Graylog via GELF UDP


Right now I'm just testing and trying diffrent things.

Right now I';m testing with just 4 servers (have close to 100) has consumed a fair bit of space

So to evaluate usage, I figured I'd just send the security logs (these are all Windows Servers)

Original working configuration
__________________________________________________________
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension gelf>
Module xm_gelf
</Extension>
<Input in>
# Use ’im_mseventlog’ for Windows XP, 2000 and 2003
Module im_msvistalog
# Uncomment the following to collect specific event logs only
Query <QueryList>\
<Query Id="0">\
<Select Path="System">*</Select>\
<Select Path="Application">*</Select>\
<Select Path="Security">*</Select>\
</Query>\
</QueryList>
</Input>
<Output out>
Module om_udp
Host 10.60.10.62
Port 12201
OutputType GELF
</Output>
<Route r>
Path in => out
</Route>
_______________________________________________________

Now I put a REM statement at the beginning of the file

# Just capturing security logs

The service won't start.
If I rem out Application and System path, it won't start.

Any suggestions?