Config works without <QueryXML> lines.
When i add thoose lines it stops sends any data.
I tested with user modification or login fail etc.

Thanks for your help

<Extension syslog>
Module xm_syslog

<Extension xml>
Module xm_xml

<Input eventlog>
Module im_msvistalog
<Query Id="0">
<Select Path="Security">*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0) and (EventID=1102 or EventID=4719 or EventID=4704 or EventID=4717 or EventID=4738 or EventID=4798 or EventID=4705 or EventID=4674 or EventID=4697 or EventID=4648 or EventID=4723 or EventID=4946 or EventID=4950 or EventID=6416 or EventID=6424 or EventID=4732)]]</Select>
Exec $Message = to_xml(); to_syslog_bsd();

<Output tcp>
Module om_tcp
Port 514

<Route eventlog_to_tcp>
Path eventlog => tcp

AskedMarch 14, 2022 - 2:21pm

Answer (1)

Hi Anıl,

There is nothing wrong with the query itself. You're probably not getting logs immediately because the events that passed the filter specified is yet to be created.

I hope this helps.