I have running Graylog 4.2 on Ubuntu 20.4 LTS.
I want to sent Windows Event Logs from some Windows Server 2016 in China to our Central Logserver in Austria. This should only happen in a certain time.
To test this i had added a schedule block to my standard config.
My input block reads the application and system events from the windows server and som specified security events, this works in the standard perfectly for me.
The reason why i want to do this in this way, is that the bandwidth our dedicated line from austria to china is not very high. So i have to sent the logs during no working hours.
The logs during the working hour, should be sent to a buffer and should be then transmitted during the allowed time period.
My config in the sidecar is the following:
define ROOT C:\Program Files (x86)\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE% Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data <Extension _gelf> Module xm_gelf </Extension> <Input win> Module im_msvistalog <QueryXML> <QueryList> <Query Id='1'> <Select Path='Application'>*</Select> <Select Path="Security">*[System[(EventID=4767 or EventID=4740)]]</Select> <Select Path='System'>*</Select> </Query> </QueryList> </QueryXML> </Input> <Processor buffer> Module pm_buffer Type disk # 100 MB disk buffer MaxSize 102400 WarnLimit 409600 </Processor> <Processor schedule> Module pm_blocker <Schedule> When 0 10 * * * Exec schedule->block(TRUE); </Schedule> <Schedule> When 0 15 * * * Exec schedule->block(FALSE); </Schedule> </Processor> <Output graylog> Module om_udp Host V.X.Y.Z Port 8514 OutputType GELF <Exec> # These fields are needed for Graylog $gl2_source_collector = '2ba8d9fb-8fc1-4447-8e85-331de205d1b5'; $SourceNodeType = 'WindowsServerEvents'; $OperatingSystem = 'Windows'; </Exec> </Output> <Route graylog_route> Path win => buffer => schedule => graylog </Route>
The Problem which i have now, is that the node is sending the logs all the time and not in the defined time period (Block from 8 - 16 and send from 16 - 8).
Or does anybody has another tip, which i could do it in a better way?
Can anybode help me with this problem?