Not receiving logs

Hi, i’m not receiving logs on my graylog server
not sure what the problem is
My sidecar logs

time="2019-04-25T10:02:59+01:00" level=info msg="Adding process runner for: nxlog" 
time="2019-04-25T10:02:59+01:00" level=info msg="[nxlog] Configuration change detected, rewriting configuration file." 
time="2019-04-25T10:02:59+01:00" level=info msg="[nxlog] Starting (svc driver)" 

nxlog logs
2019-04-25 10:02:59 INFO configuration OK
2019-04-25 10:02:59 INFO nxlog-ce-2.10.2150 started
2019-04-25 10:03:00 WARNING Due to a limitation in the Windows EventLog subsystem, a query cannot contain more than 256 sources.
2019-04-25 10:03:00 WARNING The following sources are omitted to avoid exceeding the limit in the generated query: Microsoft-Windows-SMBServer/Connectivi

My sidecar config
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module  xm_fileop
    <Schedule>
        When    @daily
        Exec    file_cycle('%ROOT%\data\nxlog.log', 7);
     </Schedule>
</Extension>


<Extension gelfExt>
  Module xm_gelf
  # Avoid truncation of the short_message field to 64 characters.
  ShortMessageLength 65536
</Extension>

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos True
        ReadFromLast True
        
        #Channel System
        #<QueryXML>
        #  <QueryList>
        #   <Query Id='1'>
        #    <Select Path='Security'>*[System/Level=4]</Select>
        #    </Query>
        #  </QueryList>
        #</QueryXML>
</Input>


<Input file>
	Module im_file
	File  "C:\GRAYLOG\test.log"
	PollInterval 1
	SavePos	True
	ReadFromLast True
	Recursive False
	RenameCheck False
	Exec $FileName = file_name(); # Send file name with each message
</Input>

<Input in>
    Module  im_file
    File    "C:\GRAYLOG\log.txt"
</Input>


<Output gelf>
	Module om_udp
	Host 0.0.0.0
	Port 5044
	OutputType  GELF
	<Exec>
	  # These fields are needed for Graylog
	  $gl2_source_collector = '${sidecar.nodeId}';
	  $collector_node_id = '${sidecar.nodeName}';
	</Exec>
</Output>


<Route route-1>
  Path eventlog => gelf
</Route>
<Route route-2>
  Path file => gelf
</Route>

Do you have 0.0.0.0 IP on your GL server?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.