Forward WinCC user auth logs with nxlog

nxlog.conf

# This is not a full nxlog.conf file!
# Paste this to your nxlog.conf
# Will regularly read the WinCC Log and extract user/auth info

<Extension csvWinCCLog>
	Module		xm_csv
	Fields		$id, $date, $time, $command, $x2, $user, $host, $x3, $x4, $x5, $x6, $x7, $x8, $x9, $x10, $x11
	FieldTypes	integer, string, string, integer, integer, string, string, string, string, string, string, string, string, string, string, string
	Delimiter	,
</Extension>

<Input in_file_WinCC_OpLog>
	Module im_file
	File 'C:\Program Files\Siemens\WinCC\diagnose\WinCC_Op_*.log'
	SavePos TRUE
	ReadFromLast TRUE
	PollInterval 30
	Exec if $raw_event == '' drop();
	
	Exec csvWinCCLog->parse_csv(); \
		if $user == 'Standard' drop(); \
		$SourceName = 'WinCC Runtime'; \
		$Hostname = hostname(); \
		$Severity = 'Notice'; \
		$MessageSourceAddress = hostname(); \
		$SyslogFacilityValue = 4; \
		if $command == 1008003 $Message = 'User: ' + $user + ' logged in.'; \
		if $command == 1008005 $Message = 'User: ' + $user + ' logged out.'; \
		if $date =~ /(\d{2})\.(\d{2})\.(\d{4})/ \
		{ \
			$EventTime = parsedate($3 + '-' + $2 + '-' + $1 + ' ' + substr($time, 0, 8)); \
		} \
		else \
		{ \
			$EventTime = now(); \
		} \
		to_syslog_bsd();
</Input>

<Route WinCCLog>
	Path		in_file_WinCC_OpLog => out_udp_514
</Route>