+1
0
-1
1
answer

Help for epoch time conversion

Hi, can anyone help me with the output of my nxlog.conf
I want to convert epoch time from my Bro logs;

Part of the logs:

1482865199.693051 FSYupp4bmRs8tT5Jyg 3 5A00020E4289E78C695848......
1482865200.300809 FmXyl22Uxsq1cudDd8 3 5A00020E4289E78C695848......
1482865200.203542 FAuSUU3X9pgdSJ2D2g 3 5A00020E4289E78C695848.......
1482865201.043722 F0KUdW3Nm5edyqPXLl 3 0CEAC9CAD430F24F334575.......

My current settings are

AskedJanuary 11, 2017 - 7:50am
+1
0
-1
1
answer

im_msvistalog EventTime being sent as String to ElasticSearch

I'm attempting to demo xnlog and running into a problem where the Windows Server 2016 event logs are being sent to AWS ElasticSearch Service with the EventTime being a string. This basically renders it impossible to index the logs, as the Kibana board requires a time-field name and is not recongizing the string as a datetime.  Any suggestions on this, or is this a potential bug with Server 2016?

AskedJanuary 6, 2017 - 7:08pm
+1
0
-1
1
answer

NXlog Exec $Hostname = hostname_fqdn(); not working

Hi everybody,

stumbled over a problem that sometimes I get hostnames from nxlog other times it's fqdns. Happens only with internal nxlog messages.I tired to fix this by using the Exec $Hostname = hostname_fqdn(); statement.

# Nxlog internal logs
<Input internal>
   Module im_internal
   Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
   Exec $Hostname = hostname_fqdn(); 
</Input>

AskedJanuary 6, 2017 - 5:36pm
+1
0
-1
1
answer

NXLog behavior when one route/output fails

I have a NXLog service running in Windows Server shipping event logs. It has 2 destinations, 1 is TCP sending logs to syslog_ng and another is GLEF UDP.

When my syslog_ng server goes offline, the logs I'm receiving at the GLEF UDP output also stops. Is there any way to make NXlog send the logs to the other output/route even if one output/route fails?

Config:

AskedJanuary 6, 2017 - 1:35pm
+1
0
-1
1
answer

im_msevent keywords datatype wrong

Hi everybody,

while experimenting with nxlog and relaying windows event logs I stumbled over the issue that even in the latest versions the

field Keywords from the Window log is defined in ms_msevent as integer which doesn't fit the values stored in the field in windows.

Are there any plans to fix this?

best regards

Tobias

 

AskedJanuary 4, 2017 - 11:05pm

Pages