I have NXLog CE latest version monitoring both Windows Event Logs and the DNS Debug log file on Server 2012 R2 and sending to TCP GELF format to a Graylog server.
I'm seeing periodic significant discrepancies between the actual amount of logs generated vs the logs that are being sent and received in my central logging platform (Graylog). from 10,000 messages per minute to 150 messages per minute, when it happens. I have verified this by getting a local copy of the dnsdebug log and checking the amount of lives vs running a query for the same time period in Graylog.
I see this drops specifically against the DNS_Debug file not against the Windows EVTX file, they come through at a normal rate.
Does anyone see anything wrong with the configuration below?
Are there Debug sources for NXlog that can be reviewed to see if internal errors are being generated?
I'm also seeing NXlog send messages with blank short_message and full_message.
This generates errors on the Graylog as well as an invalid input against a mandatory field in the GELF specification.
In terms of volume we're talking approximately 500,000 messages per 30mins.
Version : nxlog-ce-2.10.2102.msi
NB: We had to use [Exec $ShortMessage = $raw_event;] because by default the short_message field was coming through as 64 character truncated, which appears to be a default configuration.
Any help community would be greatly appreciated.
Next course of action is to set the internal logging to debug and check out what is happening.
## Title: nxlog_winsrv
## Version: 0.1
## OS: Server 2012R2
## For any concerns please contact [REDACTED]
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Exec $ShortMessage = $raw_event;
Path evtx_in, dnsDebug_in => default_out