forwarding IIS logs

#1 bthx1138

Hi all, I'm using CE edition and sending logs to Taegis XDR, I've followed the instructions at this page:  Microsoft IIS (

Configured IIS per these instructions: 

Configured nxlog.conf per these instructions: 

Logs are still not showing up, and I think I have this section in the nxlog.conf IIS config misconfigured with the IP of my Taegis CDR collecter. I've got the IP of my host entered into the HOST line, and the port entered into the PORT line. Am I supposed to comment out any of the ‘Module’ lines? Do I have it misconfigured below? Any help is appreciated, thank you in advance.


<Output W3SVCOUT>   Module      om_udp   Module      om_tcp### Guidance on TLS/SSL configuration -   Module    om_ssl   Host        x.x.x.x   Port        601   CAFile    %CERTDIR%\CA.cer   CertFile    %CERTDIR%\winhost.cer   CertKeyFile    %CERTDIR%\winhost.key   AllowUntrusted    FALSE

#2 konstantinos

Hi Brian,

Indeed only one module is allowed per configuration block, so in the W3SVCOUT Output you need to decide which of the modules you'll keep based on the protocol that your target (Taegis) is expecting on that port. You can comment out the others. 

There is a typo in the original link you've provided. The original Secureworks template can be found at: 

For example if you need TCP the output block should look like so:

<Output W3SVCOUT>
##    Module      om_udp
   Module      om_tcp
### Guidance on TLS/SSL configuration -
##    Module    om_ssl
   Host        %XDR%
   Port        %PORT%
##    CAFile    %CERTDIR%\CA.cer
##    CertFile    %CERTDIR%\winhost.cer
##    CertKeyFile    %CERTDIR%\winhost.key
##    AllowUntrusted    FALSE

### Create our RFC3164 compliant syslog line and transmit on
    Exec        $SyslogFacilityValue = 21;$Hostname=hostname_fqdn();$Severity = 'INFO';to_syslog_bsd();


I hope this helps. 

If you'd be interested to try the NXLog Enterprise Edition, please note that during the 30-day full-featured trial we can assist you on a presales level. If you later decide to purchase there are several support tier options you can chose from.

Kind regards,