Best way to write syslog to a file on windows?

[Jason]

According to the wiki the best practice for syslog is having another program write the files to disk then have Splunk monitor the files.

What are some good programs you (or your clients) have used to accomplish this?

[ftk · Accepted solution]

I have used both Kiwi Syslog Daemon and syslog-win32 with success on Windows.

If you like GUIs use Kiwi. Free version of Kiwi will let you use only a single log file though -- you will have to split by host at index time using props.conf and transforms.conf. Set up Kiwi to log to file in the Kiwi format "ISO yyyy-mm-dd Tab Delimited". Then use the following config stanzas:

inputs.conf:

[monitor://E:\Syslogd\Logs\SyslogCatchAll.txt]
sourcetype = local_syslog
source = syslog
disabled = 0

props.conf:

[local_syslog]
TRANSFORMS-localsyslog=set_local_syslog_hostname
SHOULD_LINEMERGE = false

transforms.conf:

[set_local_syslog_hostname]
DEST_KEY = MetaData:Host
REGEX = \d+\-\d+\-\d+\s+\d+:\d+:\d+\s+[\w\.]+\s+([\w\.]+)\s
FORMAT = host::$1