131.22. EventLog for Windows 2008/Vista and Later (im_msvistalog) | Log Collection Solutions

If this boolean directive is set to TRUE, names of fields parsed from the <EventData> portion of the event XML will be prefixed with EventData.. For example, $EventData.SubjectUserName will be added to the event record instead of $SubjectUserName. The same applies to <UserData>. This directive defaults to FALSE: field names will not be prefixed.

This optional directive can be used to specify the number of event records the EventLog API will pass to the module for processing. Larger sizes may increase throughput. Note that there is a known issue in the Windows EventLog subsystem: when this value is higher than 31 it may fail to retrieve some events on busy systems, returning the error "EvtNext failed with error 1734: The array bounds are invalid." For this reason, increasing this value is not recommended. The default is 31.

This boolean directive defines whether the module should store raw XML-formatted event data. If set to TRUE, the module stores raw XML data in the $EventXML field. By default, the value is set to FALSE, and the $EventXML field is not added to the record.

The name of the Channel to query. If not specified, the module will read from all sources defined in the registry. See the MSDN documentation about Event Selection.

This optional directive can be used to specify a full path to a log file. Log file types that can be used have the .evt and .evtx extensions. The path of the file must not be quoted (as opposed to im_file and om_file). If the File directive is specified, the SavePos directive will be overridden to TRUE.

File C:\Windows\System32\winevt\Logs\System.evtx

This optional directive specifies a language to use for rendering the events. The language should be given as a hyphen-separated language/region code (for example, fr-FR for French). Note that the required language support must be installed on the system. If this directive is not given, the system’s default locale is used.

This directive specifies how frequently the module will check for new events, in seconds. If this directive is not specified, the default is 1 second. Fractional seconds may be specified (PollInterval 0.5 will check twice every second).

This directive specifies the query for pulling only specific EventLog sources. See the MSDN documentation about Event Selection. Note that this directive requires a single-line parameter, so multi-line query XML should be specified using line continuation:

  
1
2
3
4
5

  
Query <QueryList>                                             \
        <Query Id='1'>                                        \
         <Select Path='Security'>*[System/Level=4]</Select>   \
        </Query>                                              \
      </QueryList>

This directive is the same as the Query directive above, except it can be used as a block. Multi-line XML queries can be used without line continuation, and the XML Query can be copied directly from Event Viewer.

  
1
2
3
4
5
6
7
8
9
10
11

  
<QueryXML>
  <QueryList>
    <!-- XML-style comments can
         span multiple lines in
         QueryXML blocks like this.
    -->
    <Query Id='1'>
      <Select Path='Security'>*[System/Level=4]</Select>
    </Query>
  </QueryList>
</QueryXML>

This optional boolean directive instructs the module to only read logs which arrived after NXLog was started if the saved position could not be read (for example on first start). When SavePos is TRUE and a previously saved position value could be read, the module will resume reading from this saved position. If ReadFromLast is FALSE, the module will read all logs from the EventLog. This can result in quite a lot of messages, and is usually not the expected behavior. If this directive is not specified, it defaults to TRUE.

This optional directive specifies the authentication method to use. Available values are Default, Negotiate, Kerberos, and NTLM. When the directive is not specified, Default is used, which is actually Negotiate.

Domain of the user used for authentication when logging on the remote server to collect event logs.

Password of the user used for authentication when logging on the remote server to collect event logs.

This optional directive specifies the name of the remote server to collect event logs from. If not specified, the module will collect locally.

Name of the user used for authentication when logging on the remote server to collect event logs.

This optional boolean directive specifies that GUID values should be resolved to their object names in the $Message field. If ResolveGUID is set to TRUE, it produces two output fields. One that retains the non-resolved form of the GUID, and another which resolves to the above mentioned object name. To differentiate the two output fields, the resolved field name will have the DN suffix added to it. If the field already exists with the same name the resolved field will not be added and the original is preserved. The default setting is FALSE; the module will not resolve GUID values. Windows Event Viewer shows the Message with the GUID values resolved, and this must be enabled to get the same output with NXLog.

This optional boolean directive specifies that SID values should be resolved to user names in the $Message field. If ResolveSID is set to TRUE, it produces two output fields. One that retains the non-resolved form of the SID, and another which resolves to the above mentioned user name. To differentiate the two output fields, the resolved field name will have the Name suffix added to it. If the field already exists with the same name the resolved field will not be added and the original is preserved. The default setting is FALSE; the module will not resolve SID values. Windows Event Viewer shows the Message with the SID values resolved, and this must be enabled to get the same output with NXLog.

This boolean directive specifies that the file position should be saved when NXLog exits. The file position will be read from the cache file upon startup. The default is TRUE: the file position is saved if this directive is not specified. Even if SavePos is enabled, it can be explicitly turned off with the global NoCache directive.

This boolean directive specifies that im_msvistalog should ignore any invalid sources in the query. The default is FALSE: im_msvistalog will fail to start if any source is invalid.