We are using Graylog2 v1.3.4 with GrayLog collector v0.4.1 on our Windows boxes to collect Windows Event Logs. I notice that on all of these Windows machines we are often (1 in 20) receiving log entries where the message field contains the text "Empty" instead of the proper entry. Valuable information is being replaced with the word "Empty".
I am looking into upgrading to NXLog for Windows log collection, but in the meantime I am curious if anyone knows why we are getting these "Empty" messages. Below is a copy of our collector.conf: server-url = "http://logs.dpptoronto.com:12900/"; > > >> inputs { > > win-eventlog-application { > > type = "windows-eventlog" > > source-name = "Application" > > poll-interval = "1s" > > } > > win-eventlog-system { > > type = "windows-eventlog" > > source-name = "System" > > poll-interval = "1s" > > } > > win-eventlog-security { > > type = "windows-eventlog" > > source-name = "Security" > > poll-interval = "1s" > > } > > } > > >> outputs { > > gelf-tcp { > > type = "gelf" > > host = "logs.dpptoronto.com" > > port = 12201 > > } > > } > > Anyone know if there a problem with the above conf file, or have any ideas about these "Empty" messages? -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/61c091f6-8598-4534-8641-4d75487c3880%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
