Is the binary src/utils/csed built or otherwise incorporated into the build?

It doesn't look like it when I built it from source because the binary wasn't built by default, but I wanted to confirm.

There is a buffer overflow in csed.c, and I need to make sure it doesn't find its way into the build.

Thanks.

Hi NXLOG Community,

the NXLOG Process 100% CPU Load after Server restart on Windows Systems.
The Problemcause is simple but i dont understand why.

A Handfull of Servers whit much logfiles (nxlogconfiguration use Wildcard for logfolder(s)).
The Logfiles are written in the Cachefile and looks okay. 
But it feels like digs through all log files.

Small footage of a Configuration:

<Input catalina>
	Module im_file
	File 'C:\Tomcat\logs\\catalina*.log'
	Recursive    True
	PollInterval 30
	SavePos      True
	CloseWhenIdle       True

	<Exec>
		#parse date
		if $raw_event =~ /(\d\d\-\S\S\S-\d\d\d\d \d\d:\d\d:\d\d)/  $EventTime = strptime($1, '%d-%b-%Y%t%H:%M:%S');
        # Now set the severity to something custom. This defaults to 'INFO' if unset.
        if $raw_event =~ /\sSEVERE\s/ $Severity = 'CRITICAL';
		else if $raw_event =~ /\sERROR\s/ $Severity = 'ERROR';
		else if $raw_event =~ /\sWARN\s/ $Severity = 'WARNING';
        else $Severity = 'INFO';

        # The facility can be also set, otherwise the default value is 'USER'.
        $SyslogFacility = 'AUDIT';
    </Exec>
</Input>

We use the Last CE Version.: nxlog-ce-3.2.2329

Thanks, regards Wolfgang 

Hi,

I am trying to insert a custom, static text into the raw event (so that the output has the custom text + the log). However, it refuses to work. The log output is the same whether I add or remove my exec $raw_event

My config input and output look like this:

 <Input in>
     Module      im_msvistalog
   <QueryXML>
      <QueryList>
         <Query Id='0'>
            <Select Path='System'>*</Select>
            <Select Path='Application'>*</Select>
            <Select Path='Security'>*</Select>
         </Query>
      </QueryList>
   </QueryXML>
	 Exec $raw_event = "STATIC CONTENT" + $raw_event;

 </Input>
 


 <Output out>
     Module      om_udp
     Host        XX.XX.XX.XX
     Port        514
     Exec        to_syslog_snare();
 </Output>


 <Route 1>
     Path        in => out
 </Route>

Logs:

2025-02-12 11:09:20 INFO nxlog-ce-3.2.2329 started

Hello  community,

Hello,

im trying to use this function to hide filenames for windows event 4663 and attempt was made to access an object:

<Processor replace_files> 

Exec if $raw_event =~ /Object Name.*\.[a-zA-Z0-9]+$/ { 

# Replace file name with 'xxxxx' and keep the file extension intact

 $raw_event = regex_replace($raw_event, '(Object Name.*\\)[^\\]+(\.[a-zA-Z0-9]+)', '\1xxxxx\2'); 

} 

</Processor>

nxlog logs keeps telling im missing a module, is this function locked to the enterprise version ? is there another way around it ?

thanks in advance 

Hi,

We are using NXLog-CE version 2.10.2150 and we prepare to deploy NX log agent in Windows server 2022.

Is Nxlog 2.10.2150 supporting log collection for Windows server 2022?

If the version is not supported, what is the minimum NX log agent to support Windows server 2022?

Thanks.

Hello All, 

In NXlog Qradar windows configuration , we have setup forwarded events as well but the for the forwarded events the source is coming as host instead of client meachine or actual source. I would request your help in fixing this. I am using the below configuration define ROOT     C:\Program Files\nxlogdefine CERTDIR  %ROOT%\certdefine CONFDIR  %ROOT%\conf\nxlog.ddefine LOGDIR   %ROOT%\data

include %CONFDIR%\\*.confdefine LOGFILE  %LOGDIR%\nxlog.logLogFile %LOGFILE%

Moduledir %ROOT%\modulesCacheDir  %ROOT%\dataPidfile   %ROOT%\data\nxlog.pidSpoolDir  %ROOT%\data

<Extension _syslog>   Module      xm_syslog</Extension>

<Extension _charconv>   Module      xm_charconv   AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32</Extension>

<Extension _exec>   Module      xm_exec</Extension>

<Extension _fileop>   Module      xm_fileop

   # Check the size of our log file hourly, rotate if larger than 5MB   <Schedule>       Every   1 hour       Exec    if (file_exists('%LOGFILE%') and \                  (file_size('%LOGFILE%') >= 5M)) \                   file_cycle('%LOGFILE%', 8);   </Schedule>

   # Rotate our log file every week on Sunday at midnight   <Schedule>       When    @weekly       Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);   </Schedule></Extension>

# Snare compatible example configuration# Collecting event log<Input in>    Module      im_msvistalog<QueryXML>       <QueryList>           <Query Id='0'>               <Select Path='Application'>*</Select>               <Select Path='Security'>*[System/Level<4]</Select>               <Select Path='System'>*</Select>   <Select Path='ForwardedEvents'>*</Select>                                </Query>       </QueryList>   </QueryXML>   <Exec>       if $Category == undef $Category = 0;       if $EventType == 'CRITICAL'       {           $EventTypeNum = 1;           $EventTypeStr = "Critical";       }       else if $EventType == 'ERROR'       {           $EventTypeNum = 2;           $EventTypeStr = "Error";       }       else if $EventType == 'INFO'       {           $EventTypeNum = 4;           $EventTypeStr = "Informational";       }       else if $EventType == 'WARNING'       {           $EventTypeNum = 3;           $EventTypeStr = "Warning";       }       else if $EventType == 'VERBOSE'       {           $EventTypeNum = 5;           $EventTypeStr = "Verbose";       }       else       {           $EventTypeNum = 0;           $EventTypeStr = "Audit";       }       if $OpcodeValue == 0 $Opcode = "Info";       if $TaskValue == 0 $TaskValue = "None";

       $EpochTime = string(integer($EventTime));       $EpochTime =~ /^(?<sec>\d+)(?<ms>\d{6})$/;       $EpochTime = $sec;

       if $TaskValue == 12288 { $TaskStr = "SE_ADT_SYSTEM_SECURITYSTATECHANGE"; }       else if $TaskValue == 12289 { $TaskStr = "SE_ADT_SYSTEM_SECURITYSUBSYSTEMEXTENSION"; }       else if $TaskValue == 12290 { $TaskStr = "SE_ADT_SYSTEM_INTEGRITY"; }       else if $TaskValue == 12291 { $TaskStr = "SE_ADT_SYSTEM_IPSECDRIVEREVENTS"; }       else if $TaskValue == 12292 { $TaskStr = "SE_ADT_SYSTEM_OTHERS"; }       else if $TaskValue == 12544 { $TaskStr = "SE_ADT_LOGON_LOGON"; }       else if $TaskValue == 12545 { $TaskStr = "SE_ADT_LOGON_LOGOFF"; }       else if $TaskValue == 12546 { $TaskStr = "SE_ADT_LOGON_ACCOUNTLOCKOUT"; }       else if $TaskValue == 12547 { $TaskStr = "SE_ADT_LOGON_IPSECMAINMODE"; }       else if $TaskValue == 12548 { $TaskStr = "SE_ADT_LOGON_SPECIALLOGON"; }       else if $TaskValue == 12549 { $TaskStr = "SE_ADT_LOGON_IPSECQUICKMODE"; }       else if $TaskValue == 12550 { $TaskStr = "SE_ADT_LOGON_IPSECUSERMODE"; }       else if $TaskValue == 12551 { $TaskStr = "SE_ADT_LOGON_OTHERS"; }       else if $TaskValue == 12552 { $TaskStr = "SE_ADT_LOGON_NPS"; }       else if $TaskValue == 12553 { $TaskStr = "SE_ADT_LOGON_CLAIMS"; }       else if $TaskValue == 12554 { $TaskStr = "SE_ADT_LOGON_GROUPS"; }       else if $TaskValue == 12800 { $TaskStr = "SE_ADT_OBJECTACCESS_FILESYSTEM"; }       else if $TaskValue == 12801 { $TaskStr = "SE_ADT_OBJECTACCESS_REGISTRY"; }       else if $TaskValue == 12802 { $TaskStr = "SE_ADT_OBJECTACCESS_KERNEL"; }       else if $TaskValue == 12803 { $TaskStr = "SE_ADT_OBJECTACCESS_SAM"; }       else if $TaskValue == 12804 { $TaskStr = "SE_ADT_OBJECTACCESS_OTHER"; }       else if $TaskValue == 12805 { $TaskStr = "SE_ADT_OBJECTACCESS_CERTIFICATIONAUTHORITY"; }       else if $TaskValue == 12806 { $TaskStr = "SE_ADT_OBJECTACCESS_APPLICATIONGENERATED"; }       else if $TaskValue == 12807 { $TaskStr = "SE_ADT_OBJECTACCESS_HANDLE"; }       else if $TaskValue == 12808 { $TaskStr = "SE_ADT_OBJECTACCESS_SHARE"; }       else if $TaskValue == 12809 { $TaskStr = "SE_ADT_OBJECTACCESS_FIREWALLPACKETDROPS"; }       else if $TaskValue == 12810 { $TaskStr = "SE_ADT_OBJECTACCESS_FIREWALLCONNECTION"; }       else if $TaskValue == 12811 { $TaskStr = "SE_ADT_OBJECTACCESS_DETAILEDFILESHARE"; }       else if $TaskValue == 12812 { $TaskStr = "SE_ADT_OBJECTACCESS_REMOVABLESTORAGE"; }       else if $TaskValue == 12813 { $TaskStr = "SE_ADT_OBJECTACCESS_CBACSTAGING"; }       else if $TaskValue == 13056 { $TaskStr = "SE_ADT_PRIVILEGEUSE_SENSITIVE"; }       else if $TaskValue == 13057 { $TaskStr = "SE_ADT_PRIVILEGEUSE_NONSENSITIVE"; }       else if $TaskValue == 13058 { $TaskStr = "SE_ADT_PRIVILEGEUSE_OTHERS"; }       else if $TaskValue == 13312 { $TaskStr = "SE_ADT_DETAILEDTRACKING_PROCESSCREATION"; }       else if $TaskValue == 13313 { $TaskStr = "SE_ADT_DETAILEDTRACKING_PROCESSTERMINATION"; }       else if $TaskValue == 13314 { $TaskStr = "SE_ADT_DETAILEDTRACKING_DPAPIACTIVITY"; }       else if $TaskValue == 13315 { $TaskStr = "SE_ADT_DETAILEDTRACKING_RPCCALL"; }       else if $TaskValue == 13316 { $TaskStr = "SE_ADT_DETAILEDTRACKING_PNPACTIVITY"; }       else if $TaskValue == 13317 { $TaskStr = "SE_ADT_DETAILEDTRACKING_TOKENRIGHTADJ"; }       else if $TaskValue == 13568 { $TaskStr = "SE_ADT_POLICYCHANGE_AUDITPOLICY"; }       else if $TaskValue == 13569 { $TaskStr = "SE_ADT_POLICYCHANGE_AUTHENTICATIONPOLICY"; }       else if $TaskValue == 13570 { $TaskStr = "SE_ADT_POLICYCHANGE_AUTHORIZATIONPOLICY"; }       else if $TaskValue == 13571 { $TaskStr = "SE_ADT_POLICYCHANGE_MPSSCVRULEPOLICY"; }       else if $TaskValue == 13572 { $TaskStr = "SE_ADT_POLICYCHANGE_WFPIPSECPOLICY"; }       else if $TaskValue == 13573 { $TaskStr = "SE_ADT_POLICYCHANGE_OTHERS"; }       else if $TaskValue == 13824 { $TaskStr = "SE_ADT_ACCOUNTMANAGEMENT_USERACCOUNT"; }       else if $TaskValue == 13825 { $TaskStr = "SE_ADT_ACCOUNTMANAGEMENT_COMPUTERACCOUNT"; }       else if $TaskValue == 13826 { $TaskStr = "SE_ADT_ACCOUNTMANAGEMENT_SECURITYGROUP"; }       else if $TaskValue == 13827 { $TaskStr = "SE_ADT_ACCOUNTMANAGEMENT_DISTRIBUTIONGROUP"; }       else if $TaskValue == 13828 { $TaskStr = "SE_ADT_ACCOUNTMANAGEMENT_APPLICATIONGROUP"; }       else if $TaskValue == 13829 { $TaskStr = "SE_ADT_ACCOUNTMANAGEMENT_OTHERS"; }       else if $TaskValue == 14080 { $TaskStr = "SE_ADT_DSACCESS_DSACCESS"; }       else if $TaskValue == 14081 { $TaskStr = "SE_ADT_DSACCESS_DSCHANGES"; }       else if $TaskValue == 14082 { $TaskStr = "SE_ADT_DS_REPLICATION"; }       else if $TaskValue == 14083 { $TaskStr = "SE_ADT_DS_DETAILED_REPLICATION"; }       else if $TaskValue == 14336 { $TaskStr = "SE_ADT_ACCOUNTLOGON_CREDENTIALVALIDATION"; }       else if $TaskValue == 14337 { $TaskStr = "SE_ADT_ACCOUNTLOGON_KERBEROS"; }       else if $TaskValue == 14338 { $TaskStr = "SE_ADT_ACCOUNTLOGON_OTHERS"; }       else if $TaskValue == 14339 { $TaskStr = "SE_ADT_ACCOUNTLOGON_KERBCREDENTIALVALIDATION"; }       else if $TaskValue == 65280 { $TaskStr = "SE_ADT_UNKNOWN_SUBCATEGORY"; }       else { $TaskStr = "Unknown[" + $taskValue + "]"; }

   if $KeywordsStr == undef {       if $TaskValue == 0 {           $KeywordsStr = 'None';       } else {           $KeywordsStr = '0';       }   }

   if $TaskStr == undef {       $TaskStr = $TaskValue;   }

   if $EventType == 'AUDIT_SUCCESS' {       $KeywordsStr = "Audit Success";       $EventTypeNum = 8;   } else {       $KeywordsStr = "Audit Failure";       $EventTypeNum = 16;   }

       $Message = "AgentDevice=WindowsLog" +           "\tAgentLogFile=" + $Channel +           "\tSource=" + $SourceName +           "\tComputer=" + hostname_fqdn() +           "\tOriginatingComputer=" + host_ip() +           "\tUser=" + $AccountName +           "\tDomain=" + $Domain +           "\tEventIDCode=" + $EventID +           "\tEventType=" + $EventTypeNum +           "\tEventCategory=" + $TaskValue +           "\tRecordNumber=" + $RecordNumber +           "\tTimeGenerated=" + $EpochTime +           "\tTimeWritten=" + $EpochTime +           "\tLevel=" + $EventTypeStr +           "\tKeywords=" + $KeywordsStr +           "\tTask=" + $TaskStr +           "\tOpcode=" + $Opcode +           "\tMessage=" + $Message;       $Hostname = host_ip();       delete($SourceName);       delete($Severity);       delete($SeverityValue);       to_syslog_bsd();   </Exec></Input>

Curious if IPv6 is supported yet? If not, is there an ETA on when it will be supported?

Hi there,  I have the following log server setup which recevice log from various servers and route to another server as well as written to a local file.

<router>

path from_other_servers => output_another_server, local_zip_encrypted_file

<\route>

it seems for smaller log size, I have to restarts the nxlog before the file can be written locally.    (the file is empty when I tried to decrypt and uncompress the file)

(1) is it possible to force flush into local file in regular basis?

(2) though I don't see the log written to local file, can I check if the log is forwarded to another server in this case?

Thanks in advance

Best regards,

Loh

Dear Community,

I am using NXlog community edition and am experiencing the problem that using the following configuration, the log sent to rsyslog arrives with the characters #011 as tab and #015 as carriage return:

<Extension _syslog>

    Module      xm_syslog

</Extension>

<Extension _charconv>

    Module xm_charconv

    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32

</Extension>

<Extension _exec>

    Module xm_exec

</Extension>

<Extension json>

    Module xm_json

</Extension>

<Input internal>

    Module im_internal

</Input>

<Input eventlog>

    Module im_msvistalog

Query <QueryList>\

    <Query Id="0">\

    <Select Path="Application">*</Select>\

    <Select Path="System">*</Select>\

    <Select Path="Security">*</Select>\

</Query>\

</QueryList>

    Exec if ($EventID == 5156) OR ($EventID == 5158) drop();

    Exec $HOSTNAME=hostname();

    Exec $Message = replace($Message, "#011", " ");

    Exec $raw_event = replace($raw_event, "#011", " ");

#    Exec $Message =~ s/(\t|\R)/ /g;

#    Exec $Message =~ s/(\t|\R|\011|\015)/ /g;

</Input> 

<Output out>

    Module om_tcp

    Host %OUTPUT_DESTINATION_ADDRESS%

    Port %OUTPUT_DESTINATION_PORT%

    Exec $Message = replace($Message, "#011", " ");

    Exec $raw_event = replace($raw_event, "#011", " ");

    Exec to_syslog_snare();

    Exec $Message = replace($Message, "#011", " ");

    Exec $raw_event = replace($raw_event, "#011", " ");

</Output>

<Route 1>

    Path eventlog, internal => out

</Route>

Can you tell me how to solve the problem? It seems not to remove the tab and carriage return characters.

Thank you very much.

Good day,

I was wondering if the CE will be releasing a version for Ubuntu 24.04 since this is a LTS release.

Thanks,

Jesse

Nxlog stops sending data to a route if another route is actively rejecting connections.

The other output stops sending data after a while (from a few minutes to a day), although TCP-connection is supported.

We use 2 routes at the same time with 1 input.

There is our nxlog config: “The in1 module is used by both routes. ”

Planforms: Windows 2016/2019 and Windows 2022

nxlog.conf

<Route r1>
    Path    in => out1
</Route>

<Route r2>
    Path    in =>  out2
</Route>

Logs:

2024-11-21 13:28:53 INFO nxlog-ce-3.2.2329 started
2024-11-21 13:28:53 INFO connecting to Graylogserver:12523
2024-11-21 13:28:53 INFO connecting to Graylogserver:12527
2024-11-21 13:28:54 INFO reconnecting in 1 seconds
2024-11-21 13:28:54 ERROR couldn't connect to tcp socket on Graylogserver:12523; No connection could be made because the target machine actively refused it.  
2024-11-21 13:28:55 INFO connecting to Graylogserver:12523
2024-11-21 13:28:56 INFO reconnecting in 2 seconds
2024-11-21 13:28:56 ERROR couldn't connect to tcp socket on Graylogserver:12523; No connection could be made because the target machine actively refused it.  
2024-11-21 13:28:58 INFO connecting to Graylogserver:12523

Hello!

I am working on integrating NXLog with Sumo Logic. I followed the instructions on how to integrate with Sumo Logic in the setup documentation, but the logs are not being forwarded to Sumo Logic correctly, even though I receive the INFO successfully connected message. I believe it may be related to the token. My input is from an SSL connection (which is successfully connecting, I tested by diverting it to a file which I'm currently using as an intermediary until I figure this out). I have tried both options below.   

Module         om_ssl   

Host              syslog.collection.us1.sumologic.com   

Port               6514   

CAFile           %CERTDIR%\digicert_ca.crt   

Exec             to_syslog_ietf();    Exec             $raw_event =~ s/(\[.*])//g; \                        $raw_event = replace($raw_event, \                        '{', '[%SUMO_TOKEN%] {', 1);

Module           om_ssl   

Host                syslog.collection.us1.sumologic.com   

Port                 6514   

CAFile             %CERTDIR%\digicert_ca.crt   

Exec                to_syslog_ietf();    Exec                $raw_event =~ s/(\[NXLOG@14506.*?\])//g; \                           $raw_event = replace($raw_event, \                           '{', '[%SUMO_TOKEN%] {', 1);

Hello everyone,

New to NXlog, doing the trial now and on setup I have encountered an issue with setting up the mail server and stuck there… 

It is a ubuntu server (AWS EC2) with postfix installed that relays to google.

Postfix works as when trying: echo "This is the body of the email" | mail -s "This is the subject line" user@ourdomain.com -r nxlog@ourdomain.com - I get the email, not an issue.

When I go to the mail server config of the web UI I always get “Failed to send email”, also the same when I try to change the email or password. I see nothing in the mail log so it seems it is not even trying to send the email?

The settings I try are:

• Host: 127.0.0.1
• Port: 25
• Sender: nxlog@ourdomain.com
• Username/Password: (empty) - as we don't auth for the local interface, this is just a local relay 

Any advice on how to proceed since I'm stuck on this step… :( 

Thank you!

With pm_null being marked for deprecation, does anyone know what the suggested alternative would be for creating modular configurations that use multiple processors?

e.ginput => p1 => p2 => output

Where p1 and p2 are pm_null modules that contain execs to perform some transformation on the event?

Hi something wrong with my API key? copy and paste to the config.  run the command below and get this error. Please help Thanks

error:

source ./master.cnf.sh && CALLED_FROM_MAKEFILE=1 ./scripts/00_check_api_key.sh[2024-11-17 17:39:21] [ERROR] Your NXLog Platform API key is invalid: MDE5MzI2MjktZGJmMy03ZmY2LThiZTMtM2Q3MDkxZjBmOTQzOm5ISlJCSVdpR1orR1RnZEUzaHUzenJHUVd2T2xBYlpHQTVGUUhLcVBuQmM9. Please double check your input.[2024-11-17 17:39:21] [ERROR] Status code returned by cloud platform.beta.nxlog.company: 401[2024-11-17 17:39:21] [INFO] You have 2 attempt(s) left to input a valid NXLog PLatform API keyEnter your NXLog PLatform API key: make: *** [Makefile:209: check-api-key] Error 1root@nxlog:/home/ubuntu# sudo nxp_manage.sh wizard 

Hello! 

I’m looking through the steps to “Enabling HTTPS for NXLog Manager” using a CA signed cert. The documentation provided is rather limited (https://docs.nxlog.co/manager/current/installation/https.html)

Any additional information you can share would be appreciated.Thanks!

I'm trying to configure an Exclude in im_file. I want to exclude logs with a date and number at the end of the filename. These files are already processed.Config:<Input PPS>  Module im_file  InputType multi_PPS  File '%LOGDIR%\\*.log'  # PPSPortaalManager_24-05-24_2.log  Exclude '*_??-??-??_*.log'  #. I've tried several notations, eg. double quotes instead of single, escaping the questionmarks. But none of them work. Searching for examples leads to 1 of 2 examples, which are very common examples, and none of them with wildcards.Using nxlog-ce-3.2.2329 .Has anyone a good, and working, example how to user Exclude in im_file?

I've been testing sending logs directly to Sentinel and am having a problem with NXLOG not liking the CA. The error is not one I'm finding a lot of online help with.

“no certificate or crl found” appears in the the log file, repeatedly.

Maybe an issue with the CA I'm pointing to? Is there a specific one for Azure Sentinel that I'm overlooking, and if so, where is that obtained?

Thanks in advance.

--B