collecting duplicate event logs
Suryaprakash
The following config is working for me to send application event logs to server via tcp, but it is sending duplicate messages for every Event Viewer event/entry.
config below as follows.
User nxlog Group nxlog
LogFile /var/log/nxlog/nxlog.log LogLevel INFO
<Extension exec> Module xm_exec </Extension>
<Extension syslog> Module xm_syslog </Extension>
<Input in> Module im_tcp Port 1514 Host 0.0.0.0 Exec parse_syslog_bsd(); </Input>
<Output out> Module om_file File "/application/logs/" + $Hostname + "" + "app.log" <Exec> if out->file_size() > 1G { set_var('newfile', file_name() + strftime(now(), '%Y%m%d%H%M%S')); rotate_to(get_var('newfile')); exec_async('/bin/bzip2', get_var('newfile')); } </Exec> </Output>
<Route 1> Path in => out </Route>
