ng-syslog log per host

В общем я затупил, срвис сислога забыл на винду поставить=)
Вот с таким на линуе логи собираются...

options {
 group(logs);
 dir_group(logs);
 perm(0600);
 dir_perm(0700);
 create_dirs(yes);
 log_fifo_size(4096);
 use_fqdn(yes);
 keep_hostname(yes);
 chain_hostnames(no);
 stats(3600);
 bad_hostname("gconfd");
};
source s_sys  {
    file ("/proc/kmsg" log_prefix("kernel: "));
    unix-stream ("/dev/log");
    internal();
    udp(ip(0.0.0.0) port(514));
};
destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" sync(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_mlal { usertty("*"); };
filter f_filter1   { facility(kern); };
filter f_filter2   { level(info..emerg) and not facility(mail,authpriv,cron); };
filter f_filter3   { facility(authpriv); };
filter f_filter4   { facility(mail); };
filter f_filter5   { level(emerg); };
filter f_filter6   { facility(uucp) or (facility(news) and level(crit..emerg)); };
filter f_filter7   { facility(local7); };
filter f_filter8   { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_auth); };
log { source(s_sys); filter(f_filter4); destination(d_mail); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_spol); };
log { source(s_sys); filter(f_filter7); destination(d_boot); };
log { source(s_sys); filter(f_filter8); destination(d_cron); };

Но все же хочу сделать на хост, вот с таким конфигом не хоит, хм...

options {
 group(logs);
 dir_group(logs);
 perm(0600);
 dir_perm(0700);
 create_dirs(yes);
 log_fifo_size(4096);
 use_fqdn(yes);
 keep_hostname(yes);
 chain_hostnames(no);
 stats(3600);
 bad_hostname("gconfd");
};
source s_sys  {
    file ("/proc/kmsg" log_prefix("kernel: "));
    unix-stream ("/dev/log");
    internal();
    udp(ip(0.0.0.0) port(514));
};
filter windows {
  program(MSWinEventLog);
};
destination windows {
  file("/var/log/archive/windows/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY"
    template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n")
    template_escape(no)
  );
};
log {
  source(s_src); filter(windows); destination(windows);
  flags(final);
};

вот такие права

# ls -al /var/log/archive/windows/
total 16
drw-r----- 2 root logs 4096 Dec  5 08:52 .
drwxr-xr-x 4 root logs 4096 Dec  5 08:52 ..