NXLog Enterprise and EVTX (eventlog) files

Hello all,

I'm currently running NXLog Enterprise in Version nxlog-4.0.3550-x64 with the following config:

<Input eventlog>
Module  im_msvistalog
File    C:\logs\Security.evtx

<Input application>
    Module  im_msvistalog
    File    C:\logs\Application.evtx

Trying to read-in from 2 local evtx files. In the nxlog.log I see the following error:

AskedJanuary 21, 2019 - 2:38pm

NXLOG capturing MS DNS Header

With the following config file I am capturing the entire MS DNS logs. This includes the DNS header info which I want to filter out. I need help figuring out what I can add that will allow me to filter out the DNS header information.

define TAP_Sender_IP XXX.XXX.XXX.XXX
define TAP_Sender_Port XXX

AskedJanuary 17, 2019 - 6:00pm

NXLOG configuration works only on test server


I am still very new with nxlog, and currently, I am very stuck. I need to configure nxlog to pick up application files (currently we are only receiving standard windows logs). For testing purposes, I have installed and configured nxlog on my test machine.

We are using extra.conf to avoid making changes in nxlog config itself, which we install on the server automatically.

AskedJanuary 16, 2019 - 4:08pm

Forwarding windows logs changes priority

Here at ABB Facts we have been using solarwinds forwarding client with Kiwi but the client is showing its age and no longer works properly.

I have set up nxlog as a replacement forwarder and it works fine but the priority is now set to Debug on all the windows events instead of Notice or Info as it was with the Solarwinds forwarder.

My conf file is very simple and shouldnt cause this problem. I have searched for a solution but without any luck.

Here is my conf file:

AskedJanuary 11, 2019 - 4:24pm