Client on windows and linux

(Adam) #1

I configure test system Windows and linux. In Windows I try configure NXLog (GELF) and have error when for test broken connection:

ERROR couldn’t connect to udp socket on; A socket operation was attempted to an unreachable network.

In this sytuation only restart NXLog service help.
I try reconfigure NXLog for syslog. After that I didn`t have log in greylog.

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension json>
 Module xm_json
<Extension syslog>
 Module xm_syslog
<Input internal>
 Module im_internal
 Exec $Message = to_json();
<Extension _syslog>
	Module      xm_gelf
<Processor buffer>
Module pm_buffer
MaxSize 102400
Type disk
<Input eventlog>
 Module im_msvistalog
 SavePos TRUE
 Query    <QueryList>\
            <Query Id="0">\
                <Select Path="Application">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
                <Select Path="Security">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
                <Select Path="System">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
                <Select Path="HardwareEvents">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
<Output out>
 Module om_tcp
 Port 12500
<Route 1>
 Path eventlog => buffer => out

(Jochen) #2

Please post the complete configuration of the input you’ve created in Graylog.

You could also use Filebeat to ship Windows Event Logs to Graylog (with a Beats input) if you can’t make NXLOG work for you.


Are clients and Graylog server in the same network?

(system) closed #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.