Skip to content

Instantly share code, notes, and snippets.

@idefux
Created June 24, 2015 09:26
Show Gist options
  • Save idefux/949e84c8ec8d4db1775c to your computer and use it in GitHub Desktop.
Save idefux/949e84c8ec8d4db1775c to your computer and use it in GitHub Desktop.
nxlog TeamViewer Log Incoming Connections
<Extension _syslog>
Module xm_syslog
</Extension>
<Input in_file_TeamViewerLog_incoming>
Module im_file
File 'C:\Program Files\TeamViewer\Connections_incoming.txt'
SavePos TRUE
ReadFromLast TRUE
PollInterval 60
Exec if $raw_event == '' drop();
Exec if $raw_event =~ /^(\S+)\s(\S+)\s(\d{2})-(\d{2})-(\d{4}) (\d.:\d.:\d.)\s(\d{2})-(\d{2})-(\d{4}) (\d.:\d.:\d.)\s(\S+)\s(\S+)\s(\S+)/ \
{ \
$Hostname = hostname(); \
$SeverityValue = 5; \
$MessageSourceAddress = hostname(); \
$SyslogFacilityValue = 4; \
$SourceName = 'TeamViewer'; \
$EventTime = parsedate($5 + '-' + $4 + '-' + $3 + ' ' + $6); \
$Message = 'ID:' + $1 + ' User:' + $2 + ' LoggedInAs:' + $11 + ' BeginTime:' + $EventTime + ' EndTime:' + parsedate($9 + '-' + $8 + '-' + $7 + ' ' + $10) + ' ['+ file_name() + ']'; \
to_syslog_bsd(); \
} \
else \
{ \
$Hostname = hostname(); \
$SeverityValue = 5; \
$MessageSourceAddress = hostname(); \
$SyslogFacilityValue = 4; \
$SourceName = 'TeamViewer'; \
$Message = $raw_event; \
to_syslog_bsd(); \
}
</Input>
<Output out>
Module om_udp
Host localhost
Port 514
</Output>
<Route TeamViewerLog>
Path in_file_TeamViewerLog_incoming => out
</Route>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment