## Please set the ROOT to your nxlog installation directory

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension syslog>
  Module xm_syslog
</Extension>

# Monitor application log files
<Input watchfile>
  Module im_file
  File 'C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\*.log'
  Exec $Message = $raw_event;
  Exec if file_name() =~ /.*\\(.*)/ $SourceName = $1;
  SavePos TRUE
  Recursive TRUE
</Input>

<Input watchfile2>
  Module im_file
  File 'C:\\Program Files\\Mozilla Firefox\\uninstall\\uninstall.log'
  Exec $Message = $raw_event;
  Exec if file_name() =~ /.*\\(.*)/ $SourceName = $1;
  SavePos TRUE
  Recursive TRUE
</Input>

# Monitor Windows event logs
<Input eventlog>
  # Uncomment for Windows Vista/2008 or later
  Module im_msvistalog

  # Uncomment for Windows 2000 or later
  # Module im_mseventlog
</Input>

<Processor eventlog_transformer>
  Module pm_transformer
  Exec $Hostname = hostname();
  OutputFormat syslog_rfc3164
</Processor>

<Processor filewatcher_transformer>
  Module pm_transformer

  # Uncomment to override the program name
  # Exec $SourceName = 'PROGRAM NAME';

  Exec $Hostname = hostname();
  OutputFormat syslog_rfc3164
</Processor>

<Output syslogout>
  Module om_udp
  Host 192.168.122.137
  Port 514
</Output>

<Route 1>
  Path eventlog => eventlog_transformer => syslogout
</Route>

<Route 2>
  Path watchfile => filewatcher_transformer => syslogout
</Route>

# Replace route 2 with this implementation if watchfile2 is active
#<Route 2>
#  Path watchfile, watchfile2 => filewatcher_transformer => syslogout
#</Route>