>There is no validation in the im_msvistalog module for these at all. If event
>subscription fails,
> the module will not start. It is not possible to detect for the >module which
> channel (or portion of the xml) is invalid.
>All the parsing and validation is handled by the windows code and the
Hi,
Regarding single vs double quotes this is surprising since it shouldn't
matter in xml.
The im_msvistalog module uses the EvtSubscribe function internally to
subscribe to events, see
http://msdn.microsoft.com/en-us/library/aa385487.aspx
Basically this function has the ChannelPath and Query para
Thanks for the quick (weekend) reply. We should BOTH be doing something else,
besides working on our weekends! :-)
OK, I'm testing on a virgin install of "Windows Edition, Windows Web Server
2008 R2". Believe it or not, it was all about the choice of "quote". I did
what you suggested, and t
Hi Trevor,
Not sure whether this is related, but your SYSLOG_LOGFILE is being
rotated by an external script without letting om_file know about it, so
this is definitely not what you should be doing.
There is reopen() procedure provided by om_file, though I'd recommend
doing the log rotation intern
Marvin,
The query below works ok for me on a W2K8R2.
Try setting Loglevel to Debug and check what query nxlog gets actually,
look for "msvistalog query xml" in nxlog.log
The query is passed to the windows eventlog API as is, nxlog does not deal
with it in any way.
For invalid channels the subscri
