Getting duplicate messages from nxlog on Windows
The following config is working for me to send windows event logs only for a specific Event Log source application, but it is sending duplicate messages for every Event Viewer event/entry. Can anybody see what the problem is with my config (below)? Running nxlog-ce-2.8.1248
define ROOT C:\Program Files (x86)\nxlogModuledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log
<Extension syslog> Module xm_syslog </Extension>
<Input eventlog1> Module im_msvistalog ReadFromLast TRUE Exec if (($Channel =~ /Application/) AND ($SourceName =~ /My app name/)); </Input>
<Input otherapp_log1> Module im_file File 'D:\Path\to\my\log\output.log' SavePos TRUE ReadFromLast TRUE PollInterval 1 Exec $Message = $raw_event; $SyslogFacilityValue = 22; </Input>
<Output graylog2> Module om_tcp Host 10.x.x.x Port 514 Exec to_syslog_bsd(); </Output>
<Route 1> Path eventlog1, otherapp_log1 => graylog2 </Route>
Figured out the problem, was missing the explicit drop() in the "Exec if". Corrected code below incase anybody else runs into this:
define ROOT C:\Program Files (x86)\nxlogModuledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log
<Extension syslog> Module xm_syslog </Extension>
define DROP_LOG_ENTRY { drop(); } define SEND_LOG_ENTRY { $Message = $raw_event; $SyslogFacilityValue = 22; }
<Input eventlog1> Module im_msvistalog ReadFromLast TRUE Exec if (($Channel =~ /Application/) AND ($SourceName =~ /My app name/)) %SEND_LOG_ENTRY% else %DROP_LOG_ENTRY% </Input>
<Input otherapp_log1> Module im_file File 'D:\Path\to\my\log\output.log' SavePos TRUE ReadFromLast TRUE PollInterval 1 Exec $Message = $raw_event; $SyslogFacilityValue = 22; </Input>
<Output graylog2> Module om_tcp Host 10.x.x.x Port 514 Exec to_syslog_bsd(); </Output>
<Route 1> Path eventlog1, otherapp_log1 => graylog2 </Route>
