2
responses

Hey,

I am currently having trouble finding a way to input multiple inputs. So I am currently forwarding my DNS log with the following:

> define ROOT C:\Program Files (x86)\nxlog
> 
> Moduledir %ROOT%\modules
> CacheDir %ROOT%\data
> Pidfile %ROOT%\data\nxlog.pid
> SpoolDir %ROOT%\data
> LogFile %ROOT%\data\nxlog.log
> 
> <Extension gelf>
>     Module xm_gelf
>     ShortMessageLength -1
> </Extension>
> 
> <Input dns>
>     Module  im_file
>     File  "C:\DNS\dns.log"
>     SavePos TRUE
>     InputType LineBased
> </Input>
> 
> <Output out> 
>     Module      om_udp
>     Host        192.168.0.168
>     Port        5414
>     OutputType  GELF
> </Output>
> 
> <Route 2>
>     Path        dns => out
> </Route>

That works 100% and I am happy with the results. The issue comes with trying to send the DNS log and sending Windows Event logs as well. I tried the following but it always comes back with errors.


Both DNS and Winlogs

> define ROOT C:\Program Files (x86)\nxlog
> 
> Moduledir %ROOT%\modules
> CacheDir %ROOT%\data
> Pidfile %ROOT%\data\nxlog.pid
> SpoolDir %ROOT%\data
> LogFile %ROOT%\data\nxlog.log
> 
> <Extension gelf>
>     Module xm_gelf
>     ShortMessageLength -1
> </Extension>
> 
> <Input in1>
>     Module      im_msvistalog
> # For windows 2003 and earlier use the following:
> #   Module      im_mseventlog
> </Input>
> 
> <Input dns2>
>     Module  im_file
>     File  "C:\DNS\dns.log"
>     SavePos TRUE
>     InputType LineBased
> </Input>
> 
> <Output out2> 
>     Module      om_udp
>     Host        192.168.0.168
>     Port        5414
>     OutputType  GELF
> </Output>
> 
> <Output out1>
>     Module      om_tcp
>     Host        192.168.0.168
>     Port        12201
>     OutputType    GELF_TCP
> </Output>
> 
> <Route 1>
>     Path        in => out
> </Route>
> 
> <Route 2>
>     Path        dns => out
> </Route>

Error: 2018-05-03 10:46:31 ERROR module 'in' is not declared at C:\Program Files (x86)\nxlog\conf\nxlog.conf:42 2018-05-03 10:46:31 ERROR module 'out' is not declared at C:\Program Files (x86)\nxlog\conf\nxlog.conf:42 2018-05-03 10:46:31 ERROR route 2 is not functional without input modules, ignored at C:\Program Files (x86)\nxlog\conf\nxlog.conf:42 2018-05-03 10:46:31 ERROR module 'dns' is not declared at C:\Program Files (x86)\nxlog\conf\nxlog.conf:46 2018-05-03 10:46:31 ERROR module 'out' is not declared at C:\Program Files (x86)\nxlog\conf\nxlog.conf:46 2018-05-03 10:46:31 ERROR route 1 is not functional without input modules, ignored at C:\Program Files (x86)\nxlog\conf\nxlog.conf:46 2018-05-03 10:46:31 WARNING no routes defined! 2018-05-03 10:46:31 WARNING not starting unused module in2 2018-05-03 10:46:31 WARNING not starting unused module dns1 2018-05-03 10:46:31 WARNING not starting unused module out1 2018-05-03 10:46:31 WARNING not starting unused module out2 2018-05-03 10:46:31 INFO nxlog-ce-2.9.1716 started

Just looking for a way to maybe input it correctly or find a way to use multiple NXLog config files

AskedMay 4, 2018 - 5:16pm

Answers (2)

The Path in => out needs to match an instance name in your <Input>and <Output> sections. In the example you listed, you are showing <Input in1> but calling "in" inside of your <Route> Directive. Since "in1" is not used in a , it ignores it. When NXLog parses the directive, there are no matching "in" and "out" .