nxlog config

nxlog.conf

# http://help.papertrailapp.com/kb/configuration/configuring-remote-syslog-from-windows

## Please set the ROOT to your nxlog installation directory

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir  %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
  Module xm_syslog  
</Extension>

# Monitor production application log file
<Input watchfile_production>
  Module im_file
  File "C:\app\WWWRootProduction\LOG\app1.LOG"  
  Exec $Message = $raw_event;
  SavePos TRUE
  Recursive TRUE
  $SourceName = 'PRODUCTION';
</Input>

# Monitor staging application log file
<Input watchfile_staging>
  Module im_file
  File "C:\app\WWWRootStaging\LOG\app2.LOG"  
  Exec $Message = $raw_event;
  SavePos TRUE
  Recursive TRUE
  $SourceName = 'STAGING';
</Input>

# Monitor Windows event logs
<Input eventlog>
  # Uncomment for Windows Vista/2008 or later 
  Module im_msvistalog
  
  # Uncomment for Windows 2000 or later
  Module im_mseventlog
</Input>

<Processor eventlog_transformer>
  Module pm_transformer
  Exec $Hostname = hostname();
  OutputFormat syslog_rfc5424  
</Processor>

<Processor filewatcher_transformer>
  Module pm_transformer
  
  # Uncomment to override the program name
  # Exec $SourceName = 'PROGRAM NAME';
    
  Exec $Hostname = hostname();
  OutputFormat syslog_rfc5424
</Processor>

<Output syslogout>
  Module om_udp
  Host logs2.papertrailapp.com
  Port xxxxx
</Output>

<Route 1>
  Path eventlog => eventlog_transformer => syslogout
</Route>

<Route 2>
  Path watchfile_production => filewatcher_transformer => syslogout
</Route>

<Route 3>
  Path watchfile_staging => filewatcher_transformer => syslogout
</Route>