1
answer

The following config is working for me to send windows event logs only for a specific Event Log source application, but it is sending duplicate messages for every Event Viewer event/entry. Can anybody see what the problem is with my config (below)? Running nxlog-ce-2.8.1248

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
  Module xm_syslog
</Extension>

<Input eventlog1>
  Module      im_msvistalog
  ReadFromLast TRUE
  Exec if (($Channel =~ /Application/) AND ($SourceName =~ /My app name/));
</Input>

<Input otherapp_log1>
  Module im_file
  File 'D:\Path\to\my\log\output.log'
  SavePos TRUE
  ReadFromLast TRUE
  PollInterval 1
  Exec $Message = $raw_event; $SyslogFacilityValue = 22;
</Input>

<Output graylog2>
  Module om_tcp
  Host 10.x.x.x
  Port 514
  Exec to_syslog_bsd();
</Output>

<Route 1>
    Path     eventlog1, otherapp_log1 => graylog2
</Route>
AskedMarch 16, 2015 - 9:37pm

Answer (1)

Figured out the problem, was missing the explicit drop() in the "Exec if". Corrected code below incase anybody else runs into this:

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
  Module xm_syslog
</Extension>

define DROP_LOG_ENTRY { drop(); }
define SEND_LOG_ENTRY { $Message = $raw_event; $SyslogFacilityValue = 22; }

<Input eventlog1>
  Module      im_msvistalog
  ReadFromLast TRUE
  Exec if (($Channel =~ /Application/) AND ($SourceName =~ /My app name/)) %SEND_LOG_ENTRY% else %DROP_LOG_ENTRY%
</Input>

<Input otherapp_log1>
  Module im_file
  File 'D:\Path\to\my\log\output.log'
  SavePos TRUE
  ReadFromLast TRUE
  PollInterval 1
  Exec $Message = $raw_event; $SyslogFacilityValue = 22;
</Input>

<Output graylog2>
  Module om_tcp
  Host 10.x.x.x
  Port 514
  Exec to_syslog_bsd();
</Output>

<Route 1>
    Path     eventlog1, otherapp_log1 => graylog2
</Route>

 

 

 

AnsweredMarch 16, 2015 - 9:46pm