responses
Hi all,
NXLOG newbie. I'm trying to inject logs from a specific hostname into a specific folder. For example:
if hostname = x
then store log in folder = y
I'm running a very bare-bones set up. I'd like to use the FQDN as the variable for hostname rather than an IP.
Current config:
Panic Soft
#NoFreeOnExit TRUE
define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf\nxlog.d
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>
<Extension _exec>
Module xm_exec
</Extension>
<Extension _fileop>
Module xm_fileop
# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
Every 1 hour
Exec if (file_exists('%LOGFILE%') and \
(file_size('%LOGFILE%') >= 5M)) \
file_cycle('%LOGFILE%', 8);
</Schedule>
# Rotate our log file every week on Sunday at midnight
<Schedule>
When @weekly
Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
</Schedule>
</Extension>
<Extension syslog>
Module xm_syslog
</Extension>
<Extension fileop>
Module xm_fileop
</Extension>
<Input udp>
Module im_udp
Host 0.0.0.0
Port 514
Exec parse_syslog();
</Input>
<Output file>
Module om_file
File "C:/Syslogs/nxlog/" + $HostName + "/" + $HostName + ".log"
CreateDir TRUE
<Exec>
if file_size("C:/Syslogs/nxlog/" + $HostName + "/" + $HostName + ".log") > 10M
{
file_cycle("C:/Syslogs/nxlog/" + $HostName + "/" + $HostName + ".log",2);
reopen();
}
</Exec>
</Output>
<Route 1>
Path udp => file
</Route>
# Snare compatible example configuration
# Collecting event log
# <Input in>
# Module im_msvistalog
# </Input>
#
# Converting events to Snare format and sending them out over TCP syslog
# <Output out>
# Module om_tcp
# Host 192.168.1.1
# Port 514
# Exec to_syslog_snare();
# </Output>
#
# Connect input 'in' to output 'out'
# <Route 1>
# Path in => out
# </Route>
Comments (1)
Thank you Kevin!
How can I designate which folder the log is forwarded to?