Nxlog for graylog

(Symbol C) #1

Hi, i have recently setup graylog and i’m using nxlog as my collector,
everything seems to be working fine except nxlog is not sending logs to the graylog server,
i have checked nxlog logs and this is the error

2019-04-16 11:51:08 ERROR failed to open C:\Users\s.chimere\Desktop\GRAYLOG; Access is denied

C:\Users\s.chimere\Desktop\GRAYLOG this is where i have my test logs that i want to send to the graylog server

Please can anyone help.

0 Likes

#2

It means, account under which nxlog service is running cannot access C:\Users\s.chimere\Desktop\GRAYLOG.

0 Likes

(Symbol C) #3

okay thank you
so the graylog server and the machine with the sidecar need to be in the same domain. yes ?

0 Likes

#4

No, this is something about permissions on computer with nxlog installed. BTW, user profile, including desktop, is not the best place for test files, Windows can create some mess with permissions there. Make some folder under C:\ and place test logs there and see if something changes.

1 Like

(Symbol C) #5

Alright thanks,
will try and revert

0 Likes

(Symbol C) #6

i think i have this sorted out but im not receiving logs,
i am trying to pull a couple of .txt logs from computer to the server
i’m using beats input and below is my nxlog config

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

Module xm_fileop When @daily Exec file_cycle('%ROOT%\data\nxlog.log', 7); Module xm_gelf # Avoid truncation of the short_message field to 64 characters. ShortMessageLength 65536 Module im_msvistalog PollInterval 1 SavePos True ReadFromLast True
    #Channel System
    #<QueryXML>
    #  <QueryList>
    #   <Query Id='1'>
    #    <Select Path='Security'>*[System/Level=4]</Select>
    #    </Query>
    #  </QueryList>
    #</QueryXML>
Module im_file File 'C:\GRAYLOG' Module im_file File "C:\GRAYLOG\log.txt" PollInterval 1 SavePos True ReadFromLast True Recursive False RenameCheck False Exec $FileName = file_name(); # Send file name with each message Module om_udp Host 192.168.3.44 Port 5044 OutputType GELF # These fields are needed for Graylog $gl2_source_collector = '${sidecar.nodeId}'; $collector_node_id = '${sidecar.nodeName}'; Path eventlog => gelf Path file => gelf
0 Likes