I am rather new to nxlog and really enjoy the product so far.  My question is, I want to ensure that ALL Windows Events on a server are being sent to my graylog server and that no logs are being omitted.  This appears to be the default conf and it should work this way, but I am just being extra sure.  Thanks very much in advance.


## This is a sample configuration file. See the nxlog reference manual about the

## configuration options. It should be installed locally and is also available

## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,

## otherwise it will not start.

#define ROOT C:\Program Files\nxlog

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules

CacheDir %ROOT%\data

Pidfile %ROOT%\data\nxlog.pid

SpoolDir %ROOT%\data

LogFile %ROOT%\data\nxlog.log

#<Extension _syslog>

#    Module      xm_syslog


<Extension gelf>

    Module      xm_gelf


<Input in>

    Module      im_msvistalog

# For windows 2003 and earlier use the following:

#   Module      im_mseventlog


<Output out>

    Module      om_udp


    Port        12201

    OutputType  GELF

#   Exec        to_syslog_snare();


<Route 1>

    Path        in => out


AskedAugust 11, 2016 - 9:16pm

Comments (1)

Answer (1)