Nagios Support Forum

Code: Select all

## See the nxlog reference manual at
## http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

#This DEFINES the ROOT folder nxlog is installed into
define ROOT D:\nxlog
define CERT D:\nxlog\cert

Moduledir D:\nxlog\modules
CacheDir D:\nxlog\cachedata
Pidfile D:\nxlog\data\nxlog.pid
SpoolDir D:\nxlog\spooldata
LogFile D:\nxlog\data\nxlog.log

# Include fileop while debugging, also enable in the output module below
#<Extension fileop>
#    Module xm_fileop
#</Extension>

<Extension json>
    Module      xm_json
</Extension>

#<Input internal>
#    Module im_internal
#</Input>

# Watch your own files
#<Input file1>
#    Module   im_file
#    File     '%ROOT%\data\nxlog.log'
#    SavePos  TRUE
#</Input>

# Windows Event Log
<Input eventlog>
# Uncomment im_msvistalog for Windows Vista/2008 and later
    Module im_msvistalog

Query <QueryList> \
<Query Id="0">\
<Select Path="Application">*</Select>\
<Select Path="System">*</Select>\
<Select Path="Security">*</Select>\
<Select Path="Setup">*</Select>\
<Select Path="ForwardedEvents">*</Select>\
</Query>\
</QueryList>

# Uncomment im_mseventlog for Windows XP/2000/2003
#   Module im_mseventlog
</Input>

<Processor buffer>
    Module      pm_buffer
    MaxSize	1900000
    Type	Mem
    WarnLimit	1572864
</Processor>

<Processor diskbuffer>
    Module  pm_buffer
    MaxSize 3145728
    Type    Disk
    File    "D:\nxlog\buffer"
    WarnLimit   2097152
</Processor>

<Output out>
    Module om_tcp
    Host 10.242.102.108
    Port 3515

    Exec  $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message");
    Exec  $raw_event = to_json();

	# Uncomment for debug output
	# Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n");
</Output>

<Route 1>
  Path eventlog => diskbuffer => buffer => out
</Route>