im_exec on schedule
Tags:
#1
kumdabur
Hello,
I'm trying to implement some kind of "inventory" module in nxlog for windows-based machines. The idea is to run CMD and get basic info like OS information, members of local admin group or active sessions of users - those are just examples, the goal would be to execute CMD and get data every X hours/days.
as a PoC, I have following configuration:
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
Module xm_syslog
Module xm_json
Module im_exec
Command "C:\Windows\System32\cmd.exe"
Arg /k
Arg dir
Module om_file
File "D:\\nxlog_debug.log"
Path message => out_debug
It works, I can see output of dir command in a .log file. However I cannot find a right way to add a "schedule". Tried in several ways, but it always fails with config error. Based on this example, is it possible to run a CMD with arguments with a schedule?
#1
kumdabur
Hello,
I'm trying to implement some kind of "inventory" module in nxlog for windows-based machines. The idea is to run CMD and get basic info like OS information, members of local admin group or active sessions of users - those are just examples, the goal would be to execute CMD and get data every X hours/days.
as a PoC, I have following configuration:
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension json>
Module xm_json
</Extension>
<Input message>
Module im_exec
Command "C:\Windows\System32\cmd.exe"
Arg /k
Arg dir
</Input>
<Output out_debug>
Module om_file
File "D:\\nxlog_debug.log"
</Output>
<Route 2>
Path message => out_debug
</Route>
It works, I can see output of dir command in a .log file. However I cannot find a right way to add a "schedule". Tried in several ways, but it always fails with config error. Based on this example, is it possible to run a CMD with arguments with a schedule?
You can use the schedule directive: https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html#config_module_schedule
It should accomplish what you need.
--MisaZ
