I'm not sure it's causing a problem, but consistently nxlog will crash on Windows when making a call to stop the nxlog service with error "System Error 109 has occurred. The pipe has ended." I'd like to fix this if anyone knows of a way.

We are using NXLog CE's im_msvistalog module to forward Windows Event Logs from the Security log, with some filtering, to an external syslog server. Functionally this works well and does exactly what we need it to. The problem we are having is that nxlog.exe process often consumes rather high percentages of a workstation's CPU in bursts. Between 25 and 35 percent every few minutes, for around a minute at a time. This is generally too much of a performance hit and I need to find some way to resolve it. I have already mitigated the size of the event log file that nxlog.exe is querying from by clearing the Security log entirely, so this is happening even on a system with not more than a few dozen log entries to read from. The query itself is fairly simple, it loads all Event ID 4625 entries from the Security log (these are logon failures). It then has a single command to drop any logon failures that were initiated for a computer account instead of a user account (this is done by reading the target account trying to logon, string parsing the account username to see if the final character is a "$", which denotes a computer account, and dropping the log if the "$" is found). What can I do to mitigate the excessive CPU usage? What I have tried so far: clearing the Windows event log that nxlog is reading from to reduce the size of the data it needs to read from disk, using UDP syslog forwarding instead of TCP, removed the parsing that dropped Event Log ID 4625 entries where the target account being logged in was a computer account instead of a user account. None of this has helped. Edit to add: I did try writing out text logging instead of syslog forwarding. This worked but I am still experiencing the periodic excessive CPU consumption. The problem is likely in the im_msvistalog input module, I would assume.

Hello, I am attempting to use Nxlog on windows to forward windows event logs as syslog. I am finding that the windows event 4672 (and only this event oddly enough) keeps getting broken into multiple lines and showing the character strings #011 and #015 May 18 10:29:20 desktop-XXXX #011#011#011SeLoadDriverPrivilege#015 May 18 10:29:20 desktop-XXXX #011#011#011SeBackupPrivilege#015 May 18 10:29:20 desktop-XXXX #011#011#011SeRestorePrivilege#015 May 18 10:29:20 desktop-XXXX #011#011#011SeDebugPrivilege#015 May 18 10:29:20 desktop-XXXX #011#011#011SeAuditPrivilege#015 May 18 10:29:20 desktop-XXXX #011#011#011SeSystemEnvironmentPrivilege #015 May 18 10:29:20 desktop-XXXX #011#011#011SeImpersonatePrivilege#015 May 18 10:29:20 desktop-XXXX #011#011#011SeDelegateSessionUserImperso natePrivilege" EventReceivedTime="2021-05-18 10:29:20" SourceModuleName="eventlog" SourceMod uleType="im_msvistalog"] {"EventTime":"2021-05-18 10:29:19","Hostname": <snip> This event also shows up with the FQDN instead of the hostname that the other events are sent with. The logs are being formatted to JSON prior to sending I reviewed the documentation and I can't determine if there is a way to effect the parsing of this message. Thanks for any input !

Hi everyone, I'm getting this issue of assignment failed at line 215, character 67 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted function 'strftime' failed at line 215, character 66 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. expression evaluation has been aborted got 'unknown' for first argument of function 'strftime(datetime, string)'. if-else failed at line 208, character 277 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted procedure 'parse_csv' failed at line 208, character 129 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted Not enough fields in CSV input, expected 17, got 0 in input '' Below is the line the error is refering to: Exec $EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S, %z'); } Kindly help me out to fix this issue and what is causing the error. Thanks.