We installed version 2.10.2150 and are using the standard out of box config file to sent syslogs to clone. Anything we can do to reduce CPU consumption? Here is our config file but I have removed IP for our clone server:

Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

<Extension _syslog>
Module xm_syslog

# Windows Event Log
<Input eventlog>
Module im_msvistalog

<Output tcp>
Module om_tcp
Host xx.xx.xx.xx
Port 514
Exec to_syslog_snare();

<Route eventlog_to_tcp>
Path eventlog => tcp

<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32

<Extension _exec>
Module xm_exec

<Extension _fileop>
Module xm_fileop

# Check the size of our log file hourly, rotate if larger than 5MB
Every 1 hour
Exec if (file_exists('%LOGFILE%') and \
(file_size('%LOGFILE%') >= 5M)) \
file_cycle('%LOGFILE%', 8);

# Rotate our log file every week on Sunday at midnight
When @weekly
Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);

AskedSeptember 19, 2019 - 12:17am

Comments (4)

  • Zhengshi's picture

    I was not able to reproduce this. I tried on a VirtualBox vm running Windows 2016 Std with same config, though I swapped om_tcp for om_null.
    I am seeing 1.3%-1.8% on my test box.

    I would trim the config to see where you are seeing this issue, i.e. which module. Feel free to use im_null and om_null.

    Your im_msvistalog is unfiltered, there may be a lot of events rolling through as well.

  • cperrone's picture

    Zhengshi, thanks for your response. How do I filter im_msvistalog? I'm not a proficient coder, we really just thought we'd be able to use this out of the box with no customization. Its replacing the Snare client in our environment. When we first installed nxlog on the vCenter Management server, it used less than 2% CPU.

  • Zhengshi's picture

    No worries, I am definitely not a proficient coder either :)

    Check out the following links. These will show you how to use Query and QueryXML in combination with the NXLog language to filter out what you need.
    What you need to collect is mostly a business level decision, but the last link has a link to the Microsoft Events to Monitor section.


Answers (0)