# NxLog Help - Logs Not Fully Ingesting

**URL:** <https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361>\
**Category:** Graylog Central (peer support)\
**Tags:** nxlog\
**Created:** [June 28, 2023, 11:01pm UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361 "2023-06-28T23:01:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![a7ebouovue8v](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@a7ebouovue8v](https://community.graylog.org/u/a7ebouovue8v)\
**Post date:** [June 28, 2023, 11:01pm UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361/1 "2023-06-28T23:01:08Z")

</div>

I’m attempting to ship Windows and App logs to Graylog via NxLog. I know it’s at least partially working because I’ll randomly receive logs in Graylog, but not all of them. I’m running Windows Server 2019 and I’m trying to send some Event Logs, Sysmon, and FileZilla logs to Graylog via TCP GELF. I’ve tried running nxlog as a server and under the administrator user.

Can someone please sanity check my nxlog config file?

* * *

Panic Soft  
#NoFreeOnExit TRUE

define ROOT C:\Program Files\nxlog  
define CERTDIR %ROOT%\cert  
define CONFDIR %ROOT%\conf\nxlog.d  
define LOGDIR %ROOT%\data

define LOGFILE %LOGDIR%\nxlog.log  
LogFile %LOGFILE%

Moduledir %ROOT%\modules  
CacheDir %ROOT%\data  
Pidfile %ROOT%\data\nxlog.pid  
SpoolDir %ROOT%\data

 Module pm\_transformer Exec $Hostname = hostname(); OutputFormat syslog\_snare Module xm\_syslog Module xm\_json Module xm\_charconv AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 Module xm\_exec Module xm\_fileop

```
# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
    Every 1 hour
    Exec if (file_exists('%LOGFILE%') and \
               (file_size('%LOGFILE%') >= 5M)) \
                file_cycle('%LOGFILE%', 8);
</Schedule>

# Rotate our log file every week on Sunday at midnight
<Schedule>
    When @weekly
    Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
</Schedule>

```

######################################################  
############## Extensions ############################

 Module xm\_gelf ########## INPUTS ########### Module im\_file File "C:\Program Files (x86)\FileZilla Server\Logs\*" Module im\_msvistalog

```
   ReadFromLast True
   BatchSize 25
   SavePos True
   PollInterval 2
   
   #TolerateQueryErrors True
   
<QueryXML>
    <QueryList>
      <Query Id="0">
	<Select Path="Security">*</Select>
      </Query>
    <Query Id="1">
	<Select Path="Application">*</Select>
      </Query>
      <Query Id="2">
	<Select Path="Setup">*</Select>
      </Query>
      <Query Id="3">
	<Select Path="System">*</Select>
      </Query>
    <Query Id="13">
        <Select Path="Microsoft-Windows-PowerShell/Admin">*</Select>
        </Query>
    <Query Id="14">
        <Select Path="Microsoft-Windows-PowerShell/Operational">*</Select>
        </Query>
    <Query Id="15">
        <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>
        </Query>
    </QueryList>

```

#######################################  
################# OUTPUTS ##############  
  
Module om\_tcp  
Host 10.0.4.3  
Port 1518  
OutputType GELF

 Module om\_tcp Host 10.0.4.3 Port 1520 #Exec to\_syslog\_snare(); OutputType GELF ####################################### #################### ROUTE ########### # # Path eventlog =\> eventlog\_transformer =\> out #

\<Route 1\>  
Path eventlog =\> out

\<Route 2\>  
Path FTP =\> out\_ftp

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [June 29, 2023, 10:40pm UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361/2 "2023-06-29T22:40:23Z")

</div>

Hey @a7ebouovue8v

Not sure what you have going on with NXlog and its hard to read your configuration file, BUT here mine perhaps that will help.

```auto
define ROOT C:\Program Files (x86)\nxlog
define LOGFILE C:\Program Files (x86)\nxlog\data\nxlog.log

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension _fileop>
    Module xm_fileop
    # Check the log file size every hour and rotate if larger than 5 MB
    <Schedule>
        Every 1 hour
        <Exec>
            if (file_exists('%LOGFILE%') and file_size('%LOGFILE%') >= 5M)
                file_cycle('%LOGFILE%', 8);
        </Exec>
    </Schedule>
    # Rotate log file every week on Sunday at midnight
    <Schedule>
        When @weekly
        Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>
</Extension>

<Extension gelf>
    Module xm_gelf
 </Extension>
 
<Input zone-01>
    Module im_msvistalog
      Query <QueryList>\
                     <Query Id="0">\
                        <Select Path="Application">*</Select>\
                        <Select Path="System">*</Select>\
                        <Select Path="Security">*</Select>\
                       <Select Path="Setup">*</Select>\
                      </Query>\
     </QueryList>  
</Input>

<Output out>
    Module om_tcp 
    Host graylog.domain.com
    Port 51412
    OutputType GELF_TCP         
    Exec $Hostname = hostname_fqdn();
    Exec $FullMessage = $raw_event;    
</Output>

<Route >
    Path zone-01 => out
</Route>

```

---

<div class="post-metadata">

**Author:** ![a7ebouovue8v](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@a7ebouovue8v](https://community.graylog.org/u/a7ebouovue8v)\
**Post date:** [June 29, 2023, 11:32pm UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361/3 "2023-06-29T23:32:44Z")

</div>

Yea, I don’t know what happened with my paste there.

Your config fixed my issue. Thank you so much!

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [June 30, 2023, 2:06am UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361/4 "2023-06-30T02:06:51Z")

</div>

hey @a7ebouovue8v

> [@a7ebouovue8v](#):
>
> Yea, I don’t know what happened with my paste there

It happens 😆 , if you could mark this post as resolved for future searches that would be great 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 14, 2023, 2:06am UTC](https://community.graylog.org/t/nxlog-help-logs-not-fully-ingesting/29361/5 "2023-07-14T02:06:57Z")

</div>

Closed on July 14, 2023, 2:06am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.