## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

define ROOT C:\Program Files\nxlog
#define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log


<Extension syslog>
	Module	xm_syslog
</Extension>

<Extension charconv>
	Module	xm_charconv
	AutodetectCharsets	utf-8, iso8859-2
</Extension>

<Input msevent>
	Module	im_mseventlog
	UTF8	TRUE
	Exec	if $FileName == "System" $SyslogFacilityValue = syslog_facility_value("daemon");
	Exec	if $FileName == "Application" $SyslogFacilityValue = syslog_facility_value("user");
	Exec	if $FileName == "Security" $SyslogFacilityValue = syslog_facility_value("auth");
</Input>

<Input firewall>
	Module	im_file
	File	"\windows\pfirewall.log"
	InputType	LineBased
	Exec	$Message = $raw_event;
	Exec	$SourceName = "firewall";
	Exec	$SyslogFacilityValue = syslog_facility_value("kern");
	Exec	$SyslogSeverityValue = syslog_severity_value("notice");
	
	# Convert Microsoft Windows Firewall Logformat:
	# 					                              ip-   ip-   src   dst         tcp                icmp  icmp
	#           		       date time action proto src   dst   port  port  size flags syn ack  win  type  code  info  path
	#   		                1        2      3     4     5     6     7     8     9              10    11   12   13    14
	Exec	if $raw_event =~ /^(\S+ \S+) (\S+) (\S+) (\S+) (\S+) (\S+) (\S+) (\S+) (\S+) \S+ \S+ (\S+) (\S+) (\S+) (\S+) (\S+)/ { \
		$EventTime = parsedate($1); \
		$Src = ""; \
		$Dst = ""; \
		$Proto = ""; \
		$Spt = ""; \
		$Dpt = ""; \
		$Flags = ""; \
		$Window = ""; \
		$IcmpType = ""; \
		$IcmpCode = ""; \
		$Info = ""; \
		if $4 != "-" { $Src = "SRC=" + $4 + " "; } \
		if $5 != "-" { $Dst = "DST=" + $5 + " "; } \
		if $3 != "-" { $Proto = "PROTO=" + $3 + " "; } \
		if $8 != "-" { $Len = "LEN=" + $8 + " "; } \
		if $6 != "-" { $Spt = "SPT=" + $6 + " "; } \
		if $7 != "-" { $Dpt = "DPT=" + $7 + " "; } \
		if $9 != "-" { $Flags = "FLAGS=" + $9 + " "; } \
		if $10 != "-" { $Window = "WINDOW=" + $10 + " "; } \
		if $11 != "-" { $IcmpType = "TYPE=" + $11 + " "; } \
		if $12 != "-" { $IcmpCode = "CODE=" + $12 + " "; } \
		if $13 != "-" { $Info = "INFO=" + $13 + " "; } \
		$Message = $14 + " " + $2 + " " + $Src + $Dst + $Proto + $Spt + $Dpt + $Len + $Flags + $Window + $IcmpType + $IcmpCode + $Info; \
	}
</Input>

<Input internal>
	Module	im_internal
</Input>

<Processor syslogizer>
	Module		pm_transformer
	OutputFormat	syslog_rfc3164
</Processor>

<Output rsyslog>
	Module		om_tcp
	Host		tuxy.red
	Port		514
	OutputType	LineBased
</Output>

<Route 1>
	Path	msevent, firewall, internal => syslogizer => noacute => rsyslog
</Route>

<Processor noacute>
	Module	pm_null

	Exec	$SourceName = replace($SourceName, "\xc3\x81", "A");
	Exec	$SourceName = replace($SourceName, "\xc3\x89", "E");
	Exec	$SourceName = replace($SourceName, "\xc3\x8d", "I");
	Exec	$SourceName = replace($SourceName, "\xc3\x93", "O");
	Exec	$SourceName = replace($SourceName, "\xc3\x95", "O");
	Exec	$SourceName = replace($SourceName, "\xc3\x96", "O");
	Exec	$SourceName = replace($SourceName, "\xc3\x9a", "U");
	Exec	$SourceName = replace($SourceName, "\xc3\x9c", "U");
	Exec	$SourceName = replace($SourceName, "\xc3\xa1", "a");
	Exec	$SourceName = replace($SourceName, "\xc3\xa9", "e");
	Exec	$SourceName = replace($SourceName, "\xc3\xad", "i");
	Exec	$SourceName = replace($SourceName, "\xc3\xb3", "o");
	Exec	$SourceName = replace($SourceName, "\xc3\xb5", "o");
	Exec	$SourceName = replace($SourceName, "\xc3\xb6", "o");
	Exec	$SourceName = replace($SourceName, "\xc3\xba", "u");
	Exec	$SourceName = replace($SourceName, "\xc3\xbc", "u");
	Exec	$SourceName = replace($SourceName, "\xc5\x90", "O");
	Exec	$SourceName = replace($SourceName, "\xc5\x91", "o");
	Exec	$SourceName = replace($SourceName, "\xc5\xa8", "U");
	Exec	$SourceName = replace($SourceName, "\xc5\xa9", "u");
	Exec	$SourceName = replace($SourceName, "\xc5\xb0", "U");
	Exec	$SourceName = replace($SourceName, "\xc5\xb1", "u");

	Exec	to_syslog_bsd();
</Processor>
