Multiple NICs on Windows server | Log collection solutions

#1 mcerone 2 years ago

Hello,

We have two Windows servers we are using NxLog agent to forward windows events to a log collection platform.

The servers have two NICs and we are getting the wrong NIC IP address in the messages forwarded by NxLog

The agent version is 4.6.4640

The server is Windows 2016 standard server

Here is the output module from the template applied

<module>om_udp</module> <config xsi:type="module-connect-address-config-mapping" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <type>OUTPUT</type> <verbatim>Exec $Hostname = string(host_ip()); Exec to_syslog_snare(); </verbatim> <connect-address>SERVERIP</connect-address> <port>514</port> <output-format>Dgram</output-format> </config>

Permalink

#2 rafDeactivated Nxlog ✓ 2 years ago

#1 mcerone

Hello, We have two Windows servers we are using NxLog agent to forward windows events to a log collection platform. The servers have two NICs and we are getting the wrong NIC IP address in the messages forwarded by NxLog The agent version is 4.6.4640 The server is Windows 2016 standard server Here is the output module from the template applied <module>om_udp</module> <config xsi:type="module-connect-address-config-mapping" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <type>OUTPUT</type> <verbatim>Exec $Hostname = string(host_ip()); Exec to_syslog_snare(); </verbatim> <connect-address>SERVERIP</connect-address> <port>514</port> <output-format>Dgram</output-format> </config>

Hello,

Since it's NXLog EE issue - please, open a ticket and our support team will pick it up.

Thanks,
Raf