nxlog on windows 2000

When I tried to run Winbox on a Windows 2000 machine, I got the following error;

The procedure entry point freeaddrinfo could not be located in the dynamic link library WS2_32.DLL

This is the Winsock 2 library and support for freeaddrinfo wasn't added until Windows XP but there is a solution. You can download a modified WS2_32.DLL from here;

http://martin.brenner.de/files/winsock2_getaddrinfo.rar

You only need to extract the compiled WS2_32.DLL from the dllfiles folder, then place the DLL in the same folder as the Winbox executable. Leave the original Windows DLL alone.

Winbox now runs on Windows 2000

download here

nxlog drop specific message 

define ROOT C:\Program Files\nxlog
## define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

 <Extension _syslog>
    Module xm_syslog

</Extension>

<Extension _charconv>
    Module          xm_charconv
    AutodetectCharsets

</Extension>

<Extension _json>
    Module xm_json

</Extension>

iso8859-2, utf-8, utf-16, utf-32

<Input in_win>
    Module im_msvistalog

Query <QueryList> \
    <Query Id="0"> \

                <Select Path="Application">*</Select> \
                <Select Path="System">*</Select> \
                <Select Path="Security">*</Select> \

            </Query> \
        </QueryList>

</Input>

<Output out_win>
    Module om_tcp

        Host 10.45.9.141
        Port 514

       Exec if $EventID == 4625 or ( $Message =~ /running/m ) drop ();

        Exec to_json();$Message=$raw_event;to_syslog_bsd();

</Output>

<Route 1>
    Path in_win => out_win

</Route>

Exec if $EventID == 4625 or ( $Message =~ /running/m ) drop (); line inside the <Output out_win> block drops the logs with the event id 4625 or any message containing the word running in them.