Hi, On Sun, 30 Jun 2013 17:25:34 +0000 Marvin Nipper <[email protected]> wrote:
> I had actually looked at that. I'm probably just being dense, but what > is not obvious in their examples is how one would use that in a > "compound" scenario, which is how most folks want to capture Windows > logs, e.g. rarely would someone "only want Security logs". More often, > then would prefer to get all of the legacy log types (i.e. Security, > System, and Application). But Channel (which seems to be optional, by > design) and Query are only allowed to be codified once each, and Channel > only allowing one parameter, so it's not possible to do this: > Channel Security,System,Application > Query * > > And it's not possible to do this: > Channel Security > Query * > Channel System > Query * > Etc. Well, it is possible with the query xml. > >The im_mseventlog module is a different beast as it uses the old eventlog > >API. When you explicitly > > specify the sources, it will try to open only those one by one. > > When this fails, it will retry again, so you should see errors about Rabbit > > not found. > FWIW, I certainly saw no failure when nxlog started. Maybe it would have > generated some > error later on? And I did get logs for the valid Sources. It should report an error when the OpenEventLog function call fails internally and I suspect an invalid eventlog name should cause that to fail. Will need to test that too. Regards, Botond ------------------------------------------------------------------------------ This SF.net email is sponsored by Windows: Build for Windows Store. http://p.sf.net/sfu/windows-dev2dev _______________________________________________ nxlog-ce-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
