No messages but no errors - sidecar nxlog

After re-installing graylog on a new server, I cannot get the previously working config to work again. This is driving me crazy because I’m sure it’s some minor detail but I could not figure it out for days now.
The setup is very simple:

one GELF UDP input on port 12201, no extractors.
one windows server, nxlog and sidecar installed - shows up under sidecars as running
assigned to the windows server is one sidecar config:

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension gelf>
	Module xm_gelf
<Input in_Eventlog>
	Module im_msvistalog
	Exec $logsource = hostname_fqdn();
	Exec $logtype = 'windowseventlog';
		  <Query Id="0">
			<Select Path="Application">*[System[(Level=1  or Level=2 or Level=3)]]</Select>
			<Select Path="Security">*[System[(Level=1  or Level=2 or Level=3)]]</Select>
			<Select Path="Setup">*[System[(Level=1  or Level=2 or Level=3)]]</Select>
			<Select Path="System">*[System[(Level=1  or Level=2 or Level=3)]]</Select>
			<Select Path="ForwardedEvents">*[System[(Level=1  or Level=2 or Level=3)]]</Select>
<Output out>
	Module om_udp
	Host serverX.domain.local
	Port 12201
	OutputType GELF
<Route oute_Eventlog>
	Path in_Eventlog => out

But I just do not receive any messages on the specified input. What bugs me is that I don’t see any errors, the nxlog log contains just the stop/start actions initiated by the sidecar config update.

running Graylog 3.2.3, graylog_sidecar_installer_1.0.2-1 and nxlog-ce-2.10.2150
i have not changed anything on the global sidecar config

I have another (syslog) input which works. There is also a pipeline configured but even if it would interfere the messages should still be visible on directly on the input or the sidecar.

any ideas would be greatly appreciated

Run tcpdump on the Graylog server. Do you see anything being received from the host running nxlog?

I don’t know the reason but as of today all messages arrive as expected.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.