1. The script for a Linux install does not exist, it is empty. I can get around that fairly easy but not convenient.
2. The Windows nxlog will not start.
I set this up on multiple Windows 2012 R2 servers (installed and ran msi and then replaced the nxlog file) and they both fail to start. I pulled the Windows text from multiple Log servers (new version) and replaced the nxlog.conf, none will start. I never had this problem in the previous versions. Here is the text of the nxlog.conf from the log server:
Code: Select all
## See the nxlog reference manual at ## http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html ## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog define CERT %ROOT%\cert Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log # Include fileop while debugging, also enable in the output module below #<Extension fileop> # Module xm_fileop #</Extension> <Extension json> Module xm_json </Extension> <Extension syslog> Module xm_syslog </Extension> <Input internal> Module im_internal </Input> # Watch your own files <Input file1> Module im_file File '%ROOT%\data\nxlog.log' SavePos TRUE </Input> # Windows Event Log <Input eventlog> # Uncomment im_msvistalog for Windows Vista/2008 and later Module im_msvistalog # Uncomment im_mseventlog for Windows XP/2000/2003 # Module im_mseventlog </Input> <Output out> Module om_tcp Host 45.55.19.153 Port 3515 Exec $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message"); Exec $raw_event = to_json(); # Uncomment for debug output # Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n"); </Output> <Route 1> Path internal, file1, eventlog => out </Route>