client nxlog file is not getting create on nxlog server

Question

I have a windows nxlog client and ubuntu nxlog server.

however my windows nxlog client logs is not getting poppulated on nxlog server.

On checking the wire via tshark, I does see my client is sending logs on nxlog server however they are not getting populated in a file.

Relevant part of nxlog server configuration file shown below.

## This is a sample configuration file. See the nxlog reference manual about   the
## configuration options. It should be installed locally under
## /usr/share/doc/nxlog-ce/ and is also available online at
## http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

########################################
# Global directives                    #
########################################
User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO

########################################
# Modules                              #
########################################
<Extension _syslog>
  Module      xm_syslog
</Extension>


<Extension _exec>
  Module      xm_exec
</Extension>

<Extension fileop>
  Module      xm_fileop
</Extension>


<Extension multiline>
  Module xm_multiline
  HeaderLine /^/
  EndLine ""
</Extension>

<Input in1>
   Module      im_udp
   Host        0.0.0.0
   Port        514
   Exec        parse_syslog();
 </Input>

<Input in2>
  Module      im_tcp
  Host        0.0.0.0
  Port        514
</Input>


<Processor norepeat>
  Module pm_norepeat
  CheckFields Hostname, SourceName, Message
</Processor>

<Output fileout1>
  Module      om_file
  #Exec        if $Message =~ /Deny/ drop();
   Exec        if $Message =~ /Teardown/ drop();
   Exec        if $Message =~ /(TRACE|DEBUG)/ drop();
   Exec        if $Message =~  /::ffff:xxxxx/ drop();
   Exec        if $Message =~  /ControlPortal.cgi/ drop();
   File        "/var/log/nxlog/" + $Hostname + ".log"
   Exec        $filename = "/var/log/nxlog/" + $Hostname + ".log";
   Exec        if (file_size($filename) > 1M) file_cycle($filename,2);
</Output>

When I check the the messagae on server from tshark I does get input from source .i.e. 172.16.130.67

apturing on 'eth1'
  1   0.000000 172.16.130.67 -> 172.16.128.6 Syslog 319 USER.NOTICE: 1 2016-12-23T11:14:16.179155+00:00xxx-PROD1 ABC - - [NXLOG@14506 EventReceivedTime="2016-12-23 11:14:16" SourceModuleName="ems" SourceModuleType="im_file"] 2016-12-23 11:14:15,719 DEBUG http-apr-80-exec-4 com.sfnt.ems.web.DOSPreventionFilter - Reached DOSPreventionFilter
1   2   0.000271 172.16.130.67 -> 172.16.128.6 Syslog 324 USER.NOTICE: 1 2016-12-23T11:14:16.179155+00:00 xxx-PROD1 abc - - [NXLOG@14506 EventReceivedTime="2016-12-23 11:14:16" SourceModuleName="ems" SourceModuleType="im_file"] 2016-12-23 11:14:15,720 INFO http-apr-80-exec-4 com.sfnt.ems.web.AuthenticationFilter - BY PASSING URI : /xxx/login.html

however the log file is not getting created in /var/log/nxlog/

I have restarted rsyslog and nxlog service.

what could else be done here to troubleshoot.