ich benutze Debian 12.05 als VM-Server für rsyslog und teste im Moment, u.a. mit einem Windows 11 Client.
Der Windows-Client ist nxlog
Die Netzwerkgeräte WLAN (Ubiquity, CISCO, Lenovo Server, etc.) funktionieren einwandfrei.
Nach einer Weile ( ca. 15 Minuten) macht mir der Client leider einen Teil seiner Meldungen/Ereignisse nicht in das %HOSTNAME% Verzeichnis rein.
Hat da mal einer einen heißen Tipp für mich?
So sieht das leider im Moment aus:
Code: Alles auswählen
drwxr-xr-x 2 root root 4,0K 29. Apr 11:42 192.168.1.10
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 BitLocker
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 C_LocalAdministrator
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 Default
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 Dienst
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 GPLI_Inventarisierung
drwxr-xr-x 2 root root 4,0K 29. Apr 11:42 NB-137
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 NB-137.technologie.local
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 RDP
drwxr-xr-x 2 root root 4,0K 29. Apr 11:36 RT-ALZ-WiFi01
drwxr-xr-x 2 root root 4,0K 29. Apr 11:35 RT-ALZ-WiFi03
drwxr-xr-x 2 root root 4,0K 29. Apr 11:34 RT-ALZ-WiFi04
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 srechte
drwxr-xr-x 2 root root 4,0K 29. Apr 11:38 SVR008
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 Uhrzeit
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 Windows
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 WindowsRemoteVerwaltung
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 WSUS
drwxr-xr-x 2 root root 4,0K 29. Apr 11:39 Zertifikate
Code: Alles auswählen
###############
#### RULES ####
###############
#
# Log anything besides private authentication messages to a single log file
#
*.*;auth,authpriv.none -/var/log/syslog
#
# Log commonly used facilities to their own log file
#
auth,authpriv.* /var/log/auth.log
cron.* -/var/log/cron.log
kern.* -/var/log/kern.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
#
##
##Eingefügt von HK 20240328
##
$template remote-incoming-logs,"/var/log/rsyslog/income/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logsCode: Alles auswählen
Panic Soft
#NoFreeOnExit TRUE
define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf\nxlog.d
define LOGDIR %ROOT%\data
include %CONFDIR%\\*.conf
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>
<Extension _exec>
Module xm_exec
</Extension>
<Extension _fileop>
Module xm_fileop
# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
Every 1 hour
Exec if (file_exists('%LOGFILE%') and \
(file_size('%LOGFILE%') >= 5M)) \
file_cycle('%LOGFILE%', 8);
</Schedule>
# Rotate our log file every week on Sunday at midnight
<Schedule>
When @weekly
Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
</Schedule>
</Extension>
#
#Changes from HK 20240411 /Begin
#
#
<Input EventLOG>
Module im_msvistalog
# <Geändert HK 20240416>
Exec if ($TargetUserName == 'SYSTEM') OR ($EventType == 'VERBOSE') drop();
# </Geändert HK 20240416>
</Input>
#
#Prozessdefinition
#Windows EventLOG konvertieren zu RFC5424
<Processor p_anco_01>
Module pm_transformer
Exec $Hostname = hostname();
OutputFormat syslog_rfc5424
</Processor>
#
#Verschicken der Events
#
<Output heron>
Module om_tcp
Host 192.168.0.8
Port 514
</Output>
#
#Routen / Pfade
#
<Route heron>
Path eventlog => p_anco_01 => heron
</Route>
#Changes from HK 20240411 /End