nxlog configuration problem in windows 10
I am trying to configure to capture windows 10 logs and it is displaying the following messages below:
2019-04-19 23:40:05 WARNING nxlog-ce received a termination request signal, exiting ... 2019-04-19 23:40:07 WARNING no functional input modules! 2019-04-19 23:40:07 WARNING no routes defined! 2019-04-19 23:40:07 WARNING not starting unused module out 2019-04-19 23:40:07 INFO nxlog-ce-2.10.2150 started
look how this nxlog.conf
Panic Soft #NoFreeOnExit TRUE
define ROOT C: \ Program Files (x86) \ nxlog define CERTDIR% ROOT% \ cert define CONFDIR% ROOT% \ conf define LOGDIR% ROOT% \ data define LOGFILE% LOGDIR% \ nxlog.log LogFile% LOGFILE%
Moduledir% ROOT% \ modules CacheDir% ROOT% \ data Pidfile% ROOT% \ data \ nxlog.pid SpoolDir% ROOT% \ data
<Extension _syslog>
Module xm_syslog
</ Extension>
<Extension gelf> Module xm_gelf </ Extension>
<Output out> Module om_tcp Host 192.168.1.48 Port 12201 #Exec to_syslog_snare (); OutputType GELF_TCP </ Output>
<Extension _charconv> Module xm_charconv AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 </ Extension>
<Extension _exec> Module xm_exec </ Extension>
<Extension _fileop> Module xm_fileop
# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
Every 1 hour
Exec if (file_exists ('% LOGFILE%') and \
(file_size ('% LOGFILE%')> = 5M)) \
file_cycle ('% LOGFILE%', 8);
</ Schedule>
# Rotate our log file every week on Sunday at midnight
<Schedule>
When @weekly
Exec if file_exists ('% LOGFILE%') file_cycle ('% LOGFILE%', 8);
</ Schedule>
</ Extension>
This is the reason:
2019-04-19 23:40:07 WARNING no functional input modules!
You are required to have at least one Input and one Output module. We then need a route.
We will make a default route using all Input and Output combined if you do not add one though.
https://nxlog.co/documentation/nxlog-user-guide-full#config-overview
Since you mention reading Windows 10 logs, please see the following section:
https://nxlog.co/documentation/nxlog-user-guide-full#windows-eventlog