Why is Nxlog is using up 100% cpu leaving system unusable? - nxlog

Question

os: Windows server 2008 R2 with
Nxlog Enterprise 4.0.3550 (64bit)
When i start nxlog it takes up 100%cpu i set the logging mode to debug but i wasnt able to find meaningful information from it. Below is my nxlog configuration where logs are sent to SIEM server 192.168.0.100
define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %LOGFILE%
LogLevel DEBUG
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension _exec>
Module xm_exec
</Extension>
<Extension _json>
Module xm_json
</Extension>
### Define our inputs ###
<Input winlog>
Module im_msvistalog
ReadFromLast TRUE
ResolveSID TRUE
<QueryXML>
<QueryList>
<Query Id='1'>
<Select Path='Application'>*</Select>
<Select Path='Security'>*</Select>
<Select Path='System'>*</Select>
</Query>
</QueryList>
</QueryXML>
</Input>
<Output winout>
Module om_tcp
Host 192.168.0.100
Port 514
Exec to_json(); $Message = $raw_event;to_syslog_bsd();
</Output>
<Route 1>
Path winlog => winout
</Route>
include %CONFDIR%\extra.conf
The debug log looks like in the pastebin link pastebin.com

Answer 1

This has been fixed since in nxlog-4.0.3689.