We are utilizing nxlog win with the im_msvistalog module. Fairly simplified json output file (om_file) with an hourly rotation. AWS Kinesis Tap is configured to read from this file as a source. We continue to experience strange situations where nxlog will appear to be running healthy as a service, but will be writing 0 lines to the output file as if the mswineventlog back end is just not functioning. When this occurs the nxlog configuration schedule will executed as expected, and rotate 0KB files into the destination folder. This is running on two domain controllers with wineventlog seeing anywhere from 20-30 individual logs per second.

Is anyone utilizing this type of configuration and experiencing any similar issues? Strangely enough a search in the forum for "kinesis" was returned with 0 results.

Panic Soft
#NoFreeOnExit TRUE

define ROOT     C:\Program Files (x86)\nxlog
define CERTDIR  %ROOT%\cert
define CONFDIR  %ROOT%\conf
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log
LogFile %LOGFILE%


Moduledir %ROOT%\modules
CacheDir  %ROOT%\data
Pidfile   %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data

<Extension _json>
    Module	xm_json
</Extension>

<Extension _exec>
    Module      xm_exec
</Extension>

<Extension _fileop>
    Module      xm_fileop

    # Check the size of our log file hourly, rotate if larger than 5MB
    <Schedule>
        Every   1 hour
        Exec    if (file_exists('%LOGFILE%') and \
                   (file_size('%LOGFILE%') >= 5M)) \
                    file_cycle('%LOGFILE%', 8);
    </Schedule>

    # Rotate our log file every week on Sunday at midnight
    <Schedule>
        When    @weekly
        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>
</Extension>

#Get logs from Windows EventLog API
<Input eventlog> 
	Module 		im_msvistalog
</Input>


#Send logs to customized file
<Output out>
	#define OUTDIR 	C:\Program Files (x86)\logs\data_nxlogs
	define OUTDIR D:\nxlog-logs
	Exec create_var('offset');
	Module 		om_file
	File		'%OUTDIR%\output.json'

	<Schedule>
		When @hourly
		<Exec>
			if not dir_exists('%OUTDIR%\Older_Logs')
				dir_make('%OUTDIR%\Older_Logs');
			rotate_to('%OUTDIR%\Older_Logs\' +strftime(now(), '%m_%d_%Y-%H_%M.log'));
		</Exec>
	</Schedule>

	<Exec>
		$EventTime = strftime($EventTime, '%Y-%m-%d %H:%M:%S %z');
	 	to_json();
	</Exec>

#Check back the previous logs and delete all logs older than 24hrs
	<Schedule>
		When @hourly
		<Exec>
			#log_info(now());
			#log_info(now() - 86400);
			set_var('offset', now() - 86400);
			if file_exists('D:\nxlog-logs\Older_Logs\' +strftime(get_var('offset'), '%m_%d_%Y-%H_%M.log'))
				file_remove('D:\nxlog-logs\Older_Logs\' +strftime(get_var('offset'), '%m_%d_%Y-%H_%M.log'));
		</Exec>
	</Schedule>
	
</Output>

<Route eventlog_to_out>
   Path eventlog => out
</Route>