Domain name in source field

Graylog Add-ons
, ,
6

Here is nxlog config , we are expecting hostname.dominname but we are getting IIS site name in place of source field and trying to find out root cause

Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

Module xm_syslog Module xm_charconv AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 Module xm_exec Module xm_fileop 
# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
    Every   1 hour
    Exec    if (file_exists('%LOGFILE%') and \
               (file_size('%LOGFILE%') >= 5M)) \
                file_cycle('%LOGFILE%', 8);
</Schedule>

# Rotate our log file every week on Sunday at midnight
<Schedule>
    When    @weekly
    Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
</Schedule>

#######################################################################

EXTENTIONS

#######################################################################

Module xm_gelf Module xm_json

#######################################################################

IIS NXLOG

#######################################################################

Module xm_csv Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken, $X-Forwarded-For FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string Delimiter ' ' QuoteChar '"' EscapeControl FALSE UndefValue - Module im_file File "C:\inetpub\logs\LogFiles\W3SVC1\u_ex*" SavePos TRUE 
Exec if $raw_event =~/^#/ drop();\
   else\
   {\
    w3c->parse_csv();\
    $EventTime = parsedate($date + " " + $time);\
$EventTime = parsedate($date + " " + $time + "Z");\
    $SourceName = "PP-IIS";\
$raw_event = to_json();\
   }
Module im_file File "C:\inetpub\logs\LogFiles\W3SVC2\u_ex*" SavePos TRUE 
Exec if $raw_event =~/^#/ drop();\
   else\
   {\
    w3c->parse_csv();\
    $EventTime = parsedate($date + " " + $time);\
$EventTime = parsedate($date + " " + $time + "Z");\
    $SourceName = "xxxx-PR-IIS";\
$raw_event = to_json();\
   }
Module om_udp Host xxxx.xxxx.xxxx.xxxx Port xxxx OutputType GELF 
Exec        $Hostname = hostname_fqdn();
    Exec    $FullMessage = $raw_event;
    #Use the following line for debugging (uncomment the fileop extension above as well)
#Exec file_write("C:\\Program Files (x86)\\nxlog\\data\\nxlog_output.log", $raw_event);
Path pp-iis => graylog Path xxxx-pr-iis => graylog

#######################################################################

/IIS NXLOG

#######################################################################