creating a query for Hyper-V

Tags:

#1 rc

Hello,

 

I would like to forward logs generated by HypErV.

In event viewer they are in Applications and Services logs -> Microsoft -> Windows -> Hyper-V-*

I tried to add a query in the input configuration but I didn't manage to find the correct path to configure.

I tried several path but each time I have an error "the channel was not found "

Query <QueryList> \

           <Query Id="0"> \
            <Select Path="Security">*</Select> \
            <Select Path="Hyper-V-logs">*</Select> \
           </Query> \
          </QueryList>
</Input>

What should I put instead of Hyper-V-logs to send hyperV logs?

Can someone help me?

 

Regards,

 

#2 b0ti Nxlog ✓
#1 rc

Hello,

 

I would like to forward logs generated by HypErV.

In event viewer they are in Applications and Services logs -> Microsoft -> Windows -> Hyper-V-*

I tried to add a query in the input configuration but I didn't manage to find the correct path to configure.

I tried several path but each time I have an error "the channel was not found "

Query <QueryList> \

           <Query Id="0"> \
            <Select Path="Security">*</Select> \
            <Select Path="Hyper-V-logs">*</Select> \
           </Query> \
          </QueryList>
</Input>

What should I put instead of Hyper-V-logs to send hyperV logs?

Can someone help me?

 

Regards,

 

You can just copy-paste the XML query from event viewer into <QueryXML> and it should work.

See https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer/ and https://nxlog.co/documentation/nxlog-user-guide#windows-eventlog