Hi, I'm currently using nxlog to forward RADIUS messages via syslog to my firewall. However, it has recently started complaining that the packets are too big, and so fragmentation is occurring which it doesn't like. The temporary fix was to force the packets to cut at 1450 bytes, and this is my current config: Panic Soft #NoFreeOnExit TRUE define ROOT C:\Program Files (x86)\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE% Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data <Extension _xml> Module xm_xml </Extension> <Extension _charconv> Module xm_charconv AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 </Extension> <Extension _exec> Module xm_exec </Extension> <Extension _fileop> Module xm_fileop # Check the size of our log file hourly, rotate if larger than 5MB &lt;Schedule&gt; Every 1 hour Exec if (file_exists('%LOGFILE%') and \ (file_size('%LOGFILE%') &gt;= 5M)) \ file_cycle('%LOGFILE%', 8); &lt;/Schedule&gt; # Rotate our log file every week on Sunday at midnight &lt;Schedule&gt; When @weekly Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8); &lt;/Schedule&gt; </Extension> <Input NPS> Module im_file File "C:\Windows\System32\LogFiles\IN*.log" InputType LineBased SavePos TRUE ReadFromLast TRUE &lt;Exec&gt; # Discard everything that doesn't seem to be an xml event if $raw_event !~ /^&lt;Event&gt;/ drop(); # Filter to only events containing all required data (type, username and ip) if $raw_event !~ /(Type\sdata_type=&quot;0&quot;&gt;)(\d{1,2})(&lt;\/Acct)(.+)(Name\sdata_type=&quot;1&quot;&gt;)([a-zA-Z0-9\$\._-]{3,15})(.*)(&lt;\/User)(.+)(Address\sdata_type=&quot;3&quot;&gt;)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})(&lt;\/Framed)/ drop (); # Truncates event to 1400 bytes due to MTU limits $raw_event = substr($raw_event, 0, 1450); # Reduces event string to just required data (type, username and ip) # Parse xml parse_xml(); &lt;/Exec&gt; </Input> <Output Firewall> Module om_udp # Put your Firewal Management interface IP address # Don't change port or protocol (should be UDP 514 or TCP 6514) Host 192.168.1.1 Port 514 </Output> <Output SyslogServer> # Put your Syslog Server IP address and port # Allows monitoring of messages being sent to firewall Module om_udp Host 192.168.1.10 Port 514 </Output> <Route 1> Path NPS => Firewall </Route> <Route 2> Path NPS => SyslogServer </Route> However, I'd prefer a neater solution, rather than just chopping the end off the packet. The only parts of the packet I'm interested in forwarding are: Event Regex: <Acct-Status-Type\sdata_type="0">1</Acct-Status-Type>{1} Username Regex: <User-Name\sdata_type="1">([a-zA-Z0-9\._-]+)</User-Name> Address Regex: <Framed-IP-Address\sdata_type="3">([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})</Framed-IP-Address> Is there a way to extract just those bits and parse that to the output? Apologies if it's obvious, but I don't really understand how nxlog works! Give me powershell and I'm happy.... Thanks, Stephen

Hi All, Im trying to get Microsoft NPS text file logs sent on to our firewall. I can get them forwarded if they are in .xml format as DTS compatible logs however I need them as IAS type files. I understand that there is a native parser for the Enterprise Edition and I have tried to obtain a quote form NXLog but as of yet not received any communication. Has anyone else out there achieved this with the CE version of nxlog and could they offer some advise on what the config would look like. Thanks :-)