WIndows Logs

We don’t normally work directly with nxlog.conf (or nxlog) anymore, but the NXLog documentation is probably the best place for anything to do with it - specifically the file directive is documented here: https://docs.nxlog.co/refman/current/im/file.html . It also has a few examples, so hopefully that helps.

Hi Ronny, this will get you going with your task. :)

## LB Forsikring logs til Eget LogPoint system E-Boks Kviterings filer v 2.0
## Kai Gustafson 08/05-2023
## comments
## 64 Bit Version
define ROOT C:\Program Files\nxlog
ModuleDir %ROOT%\modules
CacheDir  %ROOT%\data
PidFile   %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data
define Cdrive C:\Logs
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf

# Note that these two lines define constants only; the log file location
# is ultimately set by the `LogFile` directive (see below). The
# `MYLOGFILE` define is also used to rotate the log file automatically
# (see the `_fileop` block).
define LOGDIR %ROOT%\data
define MYLOGFILE %LOGDIR%\nxlog.log

# By default, `LogFile %MYLOGFILE%` is set in log4ensics.conf. This
# allows the log file location to be modified via NXLog Manager. If you
# are not using NXLog Manager, you can instead set `LogFile` below and
# disable the `include` line.
LogFile %MYLOGFILE%
#include %CONFDIR%\log4ensics.conf

<Extension _syslog>
Module  xm_syslog
</Extension>

<Extension _json>
Module xm_json
</Extension>

#Get C-drive logs files
<Input CdriveLogs>
Module    im_file
File        '%Cdrive%\*.log'
SavePos TRUE
ReadFromLast TRUE
PollInterval 1
</Input>

#Internal NXlog messages
<Input Internal>
Module im_internal
</Input>

<Input EventLog>
Module im_msvistalog
# By default we collect 'Application', 'System', and 'Security'
Query <QueryList> \
<Query Id="0"> \
<Select Path="Microsoft-Windows-Sysmon/Operational">*</Select> \
<Select Path="Application">*</Select> \
<Select Path="System">*</Select> \
<Select Path="Security">*</Select> \
</Query> \
</QueryList>
Exec $Hostname   = hostname_fqdn();
</Input>

#Syslog to LogPoint server
<Output out>
Module      om_udp
Host        xx.xx.xx.xx:514
Exec         to_json();$Message=$raw_event;to_syslog_bsd();
</Output>

<Output Cdrive_out>
Module      om_udp
Host        xx.xx.xx.xx:514
Exec        $SourceName = 'CdriveFiles';
Exec        to_syslog_bsd();
</Output>

<Route 1>
Path        eventlog, internal => out
</Route>

<Route 2>
Path        CdriveLogs => Cdrive_out
</Route>

Regards Kai