# # Service is enabled, can be started manually (Required). 
# service_start_type = "OnDemand" 
# # Disabled service (Required). 
# service_start_type = "Disabled" 
# # Autostart on system startup (Required). 
service_start_type = "AutoStart" 
# # Start delay in secs (Required). 
start_delay = 10 
 
[nec_config] 
# Log level. One of ["info", "debug","error", "warn", "trace"]. 
# Default = "info" 
log_level = "info" 
  
# Win Event Wmi section. 
# Can connect to local machines. 
# Describes by set (must be uniq) of [[nec_config.win_event_wmi]] sections.
   
# Local 1 
[[nec_config.win_event_wmi]] 
    
[nec_config.win_event_wmi.local] 
# Namespace path (Optional, default = "ROOT\\\\CIMV2").
 # namespace_path = "local1" 
   
[nec_config.win_event_wmi.local.poll_config]
 # Polling interval in secs (Required). 
interval = 5 
# List of log files (Required). 
log_files = ["Application"] 
  
# # Local 2
# [[nec_config.win_event_wmi]]
   
# [nec_config.win_event_wmi.local] 
# # Namespace path (Optional, default = "ROOT\\\\CIMV2"). 
# namespace_path = "local2" 
  
# [nec_config.win_event_wmi.local.poll_config]
 # # Polling interval in secs (Required). # interval = 5 
# # List of log files (Required). 
# log_files = ["Application", "Windows Powershell"]
   
# # Win Event Subscriber section (enable only for Windows.Client >= Vista & Windows.Server >= 2008). 
# [nec_config.win_event_subscriber] 
# # A query that specifies the types of events that you want the subscription service to return. 
# x_query = ''' 
# <QueryList> 
     #   <Query Id="0">
          #     <Select Path="Windows PowerShell">*</Select>
          #     <Select Path="Application">*</Select>
     #   </Query> 
# </QueryList> 
# ''' 
   
# File Watcher section. [nec_config.file_watcher] 
# Paths for watch (Required). 
paths = ['D:\path.txt'] 
# # Retrys to send event to inner channel (Optional, default = 3). 
# send_to_channel_retrys = 3
   
# Poll watcher kind.
 [nec_config.file_watcher.watcher_kind.poll] 
# Polling interval in secs (Required).
 interval = 5 
   
# # Recommended watcher (get notification from system, maybe not work in some cases). 
# [nec_config.file_watcher.watcher_kind.recommended] 
   
# Event Sender section. 
   
# Udp section.
 [nec_config.event_sender_config.udp] 
local_addr = "0.0.0.0" 
local_port = 8081 
remote_addr = "127.0.0.1" 
remote_port = 514 
# # Bound of inner channel for events (Optional, default = 10000). 
# channel_bound = 10000 
   
# # Tcp section. 
# [nec_config.event_sender_config.tcp] 
# remote_addr = "127.0.0.1"
# remote_port = 8888