0

Using nxlog 'im_mseventlog' module I'm able to forward all Windows Logs (Application, Security, System... ) logs to the remote syslog server. But I'm not able to forward eventlogs present under 'Application and Service Logs -> Microsoft -> Windows -> Windows Firewall with Advanced Security Logs' to the syslog server using nxlog. Is there any module to forward those event logs

2

Got solution for forwarding 'Application and Service Logs -> Microsoft -> Windows -> Windows Firewall with Advanced Security Logs' using nxlog.

Need to add the following Query inside the 'im_msvistalog' module

Query   <QueryList>  \
                <Query Id="0">  \
                <Select Path="System">*</Select> \
            <Select Path="Application">*</Select>  \
            <Select Path="Security">*</Select> \
            <Select Path="Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">*</Select> \
            </Query> \
        </QueryList>\

This would forward the windows firewall with advanced security log along with other eventlogs. Thanks for the answers and suggestion.

| improve this answer | |
0

AFAIK there is no other EventLog modules for nxlog. It could be possible that Enterprise version is more capable in this field than Community version I assume your are using.

Maybe not directly answering your question but you can try other log shipper ... I recommend https://github.com/Cimpress-MCP/TimberWinR, it uses MS's LogParser to access EventLog.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.