else                                                       \        {                                                          \          convert_fields("AUTO", "GBK");                           \          $raw_event = replace($raw_event, ' ', '@', 1);           \          w3c->parse_csv();                                        \          $raw_event = replace($raw_event, ' ', "\t");             \          $raw_event = replace($raw_event, '@', ' ', 1);           \          $EventTime = parsedate(replace($datetime, '@', ' ', 1) + '+00:00'); \        }

　

4. 增加Output日志输出（内网通过UDP方式输出可以提高运行效率；如果需要高可靠性可采用TCP，但容易造成工作负载过大。使用to_syslog_bsd后，在input段设置的$EventTime才能有效。）

123456

   Module om_udp   Host 10.168.100.1   Port 514   Exec to_syslog_bsd();

5. 增加转发规则

123   Path IISin => IISout

四、启动NXLog

可以通过服务管理器services.msc中启动nxlog服务，或者在安装路径中双击nxlog.exe运行。

五、排错

检查安装路径\data\nxlog.log日志文件，并进行排错。如果提示如下内容（ERROR if-else failed），大多数是因为段中配置的字段和日志中的字段不匹配。

12020-04-26 14:04:24 ERROR if-else failed at line 43, character 315 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 43, character 181 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Too many fields in CSV input, expected 15, got 16 in input '...此处略去具体日志内容...'

六、实际效果

七、完整配置文件：conf\nxlog.conf

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889Panic Soft#NoFreeOnExit TRUE define ROOT     C:\Program Files (x86)\nxlogdefine CERTDIR  %ROOT%\certdefine CONFDIR  %ROOT%\confdefine LOGDIR   %ROOT%\datadefine LOGFILE  %LOGDIR%\nxlog.logLogFile %LOGFILE% Moduledir %ROOT%\modulesCacheDir  %ROOT%\dataPidfile   %ROOT%\data\nxlog.pidSpoolDir  %ROOT%\data     Module xm_csv    Fields $datetime, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-Referer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $time-taken

共4页:

上一页

1

2

3

4

下一页