Created
June 24, 2015 09:26
-
-
Save idefux/949e84c8ec8d4db1775c to your computer and use it in GitHub Desktop.
nxlog TeamViewer Log Incoming Connections
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<Extension _syslog> | |
Module xm_syslog | |
</Extension> | |
<Input in_file_TeamViewerLog_incoming> | |
Module im_file | |
File 'C:\Program Files\TeamViewer\Connections_incoming.txt' | |
SavePos TRUE | |
ReadFromLast TRUE | |
PollInterval 60 | |
Exec if $raw_event == '' drop(); | |
Exec if $raw_event =~ /^(\S+)\s(\S+)\s(\d{2})-(\d{2})-(\d{4}) (\d.:\d.:\d.)\s(\d{2})-(\d{2})-(\d{4}) (\d.:\d.:\d.)\s(\S+)\s(\S+)\s(\S+)/ \ | |
{ \ | |
$Hostname = hostname(); \ | |
$SeverityValue = 5; \ | |
$MessageSourceAddress = hostname(); \ | |
$SyslogFacilityValue = 4; \ | |
$SourceName = 'TeamViewer'; \ | |
$EventTime = parsedate($5 + '-' + $4 + '-' + $3 + ' ' + $6); \ | |
$Message = 'ID:' + $1 + ' User:' + $2 + ' LoggedInAs:' + $11 + ' BeginTime:' + $EventTime + ' EndTime:' + parsedate($9 + '-' + $8 + '-' + $7 + ' ' + $10) + ' ['+ file_name() + ']'; \ | |
to_syslog_bsd(); \ | |
} \ | |
else \ | |
{ \ | |
$Hostname = hostname(); \ | |
$SeverityValue = 5; \ | |
$MessageSourceAddress = hostname(); \ | |
$SyslogFacilityValue = 4; \ | |
$SourceName = 'TeamViewer'; \ | |
$Message = $raw_event; \ | |
to_syslog_bsd(); \ | |
} | |
</Input> | |
<Output out> | |
Module om_udp | |
Host localhost | |
Port 514 | |
</Output> | |
<Route TeamViewerLog> | |
Path in_file_TeamViewerLog_incoming => out | |
</Route> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment