1
response

Hello

windows ---> nxlog-------->graylog&splunk(syslog)

how can i do?
this conf is right?

p.s.
graylog 192.168.1.20
splunk 192.168.1.21

------------------------------------My conf------------------------------------------------------------------
Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

<Extension _syslog>
Module xm_gelf

</Extension>

<Extension _syslog>
Module xm_syslog

</Extension>

<Input in>

Module im_msvistalog

</Input>

<Output out>
Module om_udp
Host 192.168.1.20
Port 10554
OutputType GELF
</Output>

<Output out1>
Module om_udp
Host 192.168.1.21
Port 10554
Exec to_syslog_snare();
</Output>

<Route 1>
Path in => out
</Route>

<Route 2>
Path in => out1
</Route>

AskedOctober 27, 2020 - 10:39am

Answer (1)

Hello,

I don't see any obvious mistakes in your conf, however, I haven't tried it.

Please, make sure your Splunk and Graylog instances are configured to receive messages on a certain IP:PORT, in the chosen format.

In case anything doesn't work - you might want to check your nxlog.log file - please refer to the manual for some guidance.