https://www.cnblogs.com/yangjisen/archive/2020/04/26/12779324.html

 

完整配置文件：conf\nxlog.conf

 

 

Panic Soft

#NoFreeOnExit TRUE

 

define ROOT     C:\Program Files (x86)\nxlog

define CERTDIR  %ROOT%\cert

define CONFDIR  %ROOT%\conf

define LOGDIR   %ROOT%\data

define LOGFILE  %LOGDIR%\nxlog.log

LogFile %LOGFILE%

 

Moduledir %ROOT%\modules

CacheDir  %ROOT%\data

Pidfile   %ROOT%\data\nxlog.pid

SpoolDir  %ROOT%\data

 

<Extension w3c>

    Module xm_csv

    Fields $datetime, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-Referer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $time-taken

    FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string

    Delimiter ' '

    QuoteChar '"'

    EscapeControl TRUE

    UndefValue -

</Extension>

 

<Extension _syslog>

    Module      xm_syslog

</Extension>

 

<Extension _charconv>

    Module      xm_charconv

    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32

</Extension>

 

<Extension _exec>

    Module      xm_exec

</Extension>

 

<Extension _fileop>

    Module      xm_fileop

 

    # Check the size of our log file hourly, rotate if larger than 5MB

    <Schedule>

        Every   1 hour

        Exec    if (file_exists('%LOGFILE%') and \

                   (file_size('%LOGFILE%') >= 5M)) \

                    file_cycle('%LOGFILE%', 8);

    </Schedule>

 

    # Rotate our log file every week on Sunday at midnight

    <Schedule>

        When    @weekly

        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);

    </Schedule>

</Extension>

 

<Input IISin>

   Module   im_file

   # IIS日志目录，文件名支持通配符，文件夹不支持

   File     "C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log"

   SavePos  TRUE

   # 忽略以#开头的日志行

   # 编码转换为GBK（我的日志审计服务器默认为GBK编码，而IIS日志的编码为UTF-8，请按实际情况设置）

   # 合并日期与时间为一个字段

   # 解析为CSV格式

   # 通过xm_csv模块对W3C扩展日志进行解析

   # 将合并后的日期与时间作为EventTime（发生时间），并增加GMT标志(+00:00)解决IIS8小时时差问题

   Exec if $raw_event =~ /^#/ drop();                              \

        else                                                       \

        {                                                          \

          convert_fields("AUTO", "GBK");                           \

          $raw_event = replace($raw_event, ' ', '@', 1);           \

          w3c->parse_csv();                                        \

          $raw_event = replace($raw_event, ' ', "\t");             \

          $raw_event = replace($raw_event, '@', ' ', 1);           \

          $EventTime = parsedate(replace($datetime, '@', ' ', 1) + '+00:00'); \

        }

</Input>

 

<Output IISout>

   Module om_udp

   Host 10.168.100.1

   Port 514

   Exec to_syslog_bsd();

</Output>

 

<Route 1>

   Path IISin => IISout

</Route>