In a heavily loaded environment, around 250K values per minute using python modules, causes memory leaks and out of memory errors. Checked on: Ubuntu 20 LTS, Centos 8 Stream. After 15-20 minutes of working (Kafka python script) nxlog eats over 8 GB of RAM + 3G swap and crush. Every restart or reload service clean the memory. Using the perl module is not the solution. Anyone has the same? Maybe any tips to resolve it.

Hi, we have a problem with nxlog cpu usage after it loses connection to syslog-server. After losing connection the cpu usage peaks to 100% until nxlog is stopped. We are using om_ssl module and the problem only happens on rhel 8-computers. All the other computers with windows/rhel 7 are working fine with same configurations. I have tried without om_ssl-module, then it works just fine. Our system: Rocky Linux 8.6 Nxlog version ce-3.0.2272_rhel8.x86_64 As my syslog-server, i am using graylog. Is anyone else having this problem?

I have never had to parse XML files with NxLog so I am new at this process. This config file grabs Windows Event logs and some trace files from XML files. The Windows Event logs works as it should. The XML, I cannot get to work. I am not getting any output from the XML. Panic Soft #NoFreeOnExit TRUE define ROOT C:\Program Files\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE% Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data <Extension _gelf> Module xm_gelf ShortMessageLength 500 </Extension> <Extension xml> Module xm_xml </Extension> <Input EventLog_In> # Use 'im_mseventlog' for Windows XP, 2000 and 2003 Module im_msvistalog # Uncomment the following to collect specific event logs only Query <QueryList> <Query Id="0"> <Select Path="Application"></Select> <Select Path="System"></Select> <Select Path="Security">*</Select> </Query> </QueryList> </Input> <Input IISTrace_In> Module im_file File 'F:\Fileshare\Infrastructure Department\Logs\W3SVC1\fr001307.xml' Exec parse_xml(); </Input> <Output EventLog_Out> Module om_tcp Host IP SCRUBBED Port 12201 Exec to_syslog_snare(); OutputType GELF_TCP </Output> <Output IISTrace_Out> Module om_file File 'F:\Fileshare\Infrastructure Department\Logs\NxLog\Test\Test.log' </Output> <Route EventLog> Path EventLog_In => EventLog_Out </Route> <Route IISTrace> Path IISTrace_In => IISTrace_Out </Route>

Has anyone else noticed that the source code package says version nxlog-ce-3.0.2272.tar.gz and when you decompress the package it says version nxlog-ce-3.0.14 and the compiled version is nxlog-ce-3.0.14 I really appreciate nxlog-ce being free and available. Thumbs up to the developers.

Hello Team, I would like to read multiple types of CSV files from a share folder. Is it possible? Could you please share some sample?

Hi! We have nxlog ce running in a Windows machine. It works ok. If time is changed to the future, it continues forwarding logs. However, if time is changed to the past, logs are not forwarded anymore. This affects to logs from windows events, from a text file, etc. It seems that nxlog is filtering the logs and that logs with a previous time than others received are discarded. Logs are forwarded again if nxlog service is restarted (this seems to be doing a 'reset' on expected time) Do you know how could we avoid this?

Hello nxlog community, :-) we're currently in the preparation process of analyzing nxlog as potential logging software for our company and while doing so we were looking for a nxlog community edition that supports our SLES operating systems. The official download page does not list versions for any SUSE operating system. We know that SLES is supported by the enterprise edition, but for testing purposes we would like to use the community edition to get started. We've successfully compiled the community edition's source code and installed it on SLES via ... zypper in gcc apr-devel pcre-devel libopenssl-devel libexpat-devel ./configure make make install ... but doing so lacks a lot of other things (which must be taken care of manually) like creating nxlog user and group, assigning its GID, creating config files, systemd units, directories in /usr/local/etc ... What are we missing? What is the best way to get nxlog-ce installed on SLES 15 SP3? Thank you in advance. Best regards Dennis

Hello, We are using nxlog-ce 3.0.2284 on Windows 2016 to collect event logs and forward them to our new SIEM. We experience an increasing delay in the reception of these events by the SIEM. It starts with a few seconds delay and after a moment, the delay has progressively increased to hours. We collect all the event logs, without any filter and the observed throughput is around 150eps, with peaks at 700eps. The output is om_tcp with TLS. Last, we disabled the buffer processor to see if it helps, but with no improvement. The server does not seem to be very loaded in terms of RAM, CPU and disk. Are we reaching nxlog maximum performance ? Looking at the docs, it seems and the default values for BatchSize is 31 and PollInterval is 1 second. Does it mean that the maximum input thoughput is 31eps ? Lowering the PollInterval to 0.1 seconds seems to help, but is it the recommended strategy to improve performance ? How can we configure nxlog to improve the performance ? Thank you for your help ! David

Tổ hợp Sun Riverpolis Đà Nẵng Đà Nẵng sẵn sàng tâm thế đón làn sóng đầu tư mới. Phát biểu tại Diễn đàn, chủ toạ UBND thị thành Lê Trung Chinh cho biết, dù gặp nhiều khó khăn và chịu ảnh hưởng của đại dịch COVID-19, song thành thị luôn có sự chủ động và sẵn sàng để chuẩn bị đón các làn sóng dịch chuyển đầu tư mới. "Việc phủ rộng tiêm phòng vaccine cho toàn thể người dân, trong đấy mang những nhà đầu tư, các chuyên gia nước ngoài; việc thành lập những tổ công tác xúc tiến, dỡ gỡ khó khăn gặp khó khăn cho doanh nghiệp, nhà đầu tư do những đồng chí lãnh đạo của thị thành chủ trì để khai triển những dự án… đã khẳng định sự cam kết đồng hành của đô thị trong quyết tâm kiến lập niềm tin trong cộng đồng công ty và nhà đầu tư đối sở hữu môi trường đầu cơ của tỉnh thành Đà Nẵng", chủ tịch UBND thành thị Lê Trung Chinh nhấn mạnh. với chủ đề năm 2022 là “Năm thích nghi an toàn, cởi mở, kiểm soát hiệu quả dịch bệnh và hồi phục, phát triển kinh tế - phường hội” cùng những cơ chế, định hướng to đối mang sự trở thành xã trong khoảng Trung ương cộng mang sự kiểm soát tốt dịch bệnh COVID-19 thì đây chính là thời khắc phù hợp để Đà Nẵng đẩy nhanh tốc độ khai triển những Dự án và thu hút đầu cơ mạnh mẽ. Xem thêm: bán đất đầm sen nam hòa xuân. “Thành phường kỳ vọng Diễn đàn lần này sẽ thúc đẩy công tác thu hút đầu tư; tạo ra bước chuyển trong việc hiện thực hóa những Công trình động lực, trọng tâm ủ ấp trong suốt thời gian qua của đô thị. cùng lúc, được thấu hiểu và lắng nghe các quan niệm, yêu cầu từ toàn thể quý vị về các biện pháp khắc phục các rào cản, hạn chế; phát huy những lợi thế, tiềm năng và đón đầu hiệu quả các làn sóng chuyển dịch đầu tư đối sở hữu thị thành Đà Nẵng. trong khoảng đấy, chúng ta cùng chung tay để từng bước hiện thực hóa mục tiêu xây dựng một đô thị Đà Nẵng - đáng sống, đáng khiến cho việc và đáng đầu tư”, chủ tịch UBND tỉnh thành Lê Trung Chinh san sớt. Để đạt được những mục tiêu đề ra, theo chủ toạ UBND thị thành Lê Trung Chinh, trong khoảng lãnh đạo tới công chức của thị thành phải đổi mới tư duy, xác định những bí quyết làm cho mới 1 cách cụ thể, thích hợp mang quy định pháp lý và thực tế đặt ra; cũng như đặt người dân và doanh nghiệp ở vị trí đẹp của mỗi chính sách. đồng thời, rất cần sự dai sức, thông minh và sáng láng trong hồ hết hệ thống chính trị của thành phố; sự san sớt, đồng thuận từ phía người dân, cùng đồng công ty, nhà đầu tư; và đặc thù là sự định hướng, chỉ đạo kịp thời của lãnh đạo Chính phủ cùng những bộ lĩnh vực Trung ương. chủ tịch UBND thị thành Lê Trung Chinh thông tin, trong phạm vi của Diễn đàn đầu tư Đà Nẵng năm 2022 sẽ công khai thông tin về kế hoạch, tiến độ hoàn tất việc lập quy hoạch những phân khu chức năng theo Đồ án điều chỉnh quy hoạch chung Đà Nẵng tới năm 2030, tầm nhìn đến năm 2045 đã được Thủ tướng Chính phủ phê duyệt; thông tin quỹ đất và những Công trình trọng điểm để kêu gọi đầu cơ trên khu vực tỉnh thành để các nhà đầu cơ quan tâm Nhận định và khai triển thực hiện; song song sẽ bàn luận 1 số giải pháp trọng tâm đẩy mạnh công việc thu hút đầu tư chỉ cần khoảng tới. ngoài ra người mua sở hữu thể tham khảo thêm về Công trình bất động sản ở đà nẵng.

I have problem with use xm_python module. All works fine, but when add into config directive with xm_python module, I get ERROR Failed to load module from C:\Program Files\nxlog\modules\extension\xm_python.dll, The specified module could not be found. ; The specified module could not be found. This issue I have on three computers with different Windows system.

The following config file works in Ubuntu 14.04, but throws an error when used on an 18.04 server. Am I using the to_syslog_ietf() function incorrectly? ######################################## # Global directives # ######################################## User nxlog Group nxlog LogFile /var/log/nxlog/nxlog.log LogLevel INFO ##### Logging ##### <Input messages> Module im_file File "/var/log/syslog" </Input> <Input audit> Module im_file File "/var/log/audit/audit.log" # Exec $Message = $Hostname + ' ' + $raw_event; </Input> <Input auth> Module im_file File "/var/log/auth.log" </Input> <Input eve> Module im_file File "/var/log/suricata/eve.json" </Input> <Output tcp> Module om_tcp Host 10.10.10.33 Port 514 </Output> <Output tcp_audit> Module om_tcp Host 10.10.10.33 Port 514 Exec to_syslog_ietf(); </Output> <Output tcp_eve> Module om_tcp Host 10.10.10.33 Port 10002 </Output> <Route messages_to_tcp> Path messages, auth => tcp </Route> <Route messages_to_tcp_audit> Path audit => tcp_audit </Route> <Route eve_to_tcp> Path eve => tcp_eve </Route>

Hello Team, We are using below nxlog config to parse one application log file to Graylog. Nxlog is properly parsing file line by line to Graylog. But we are observing mismatch in timestamp (in 500 to 900 milliseconds) for actual event and showing in Graylog. Please let us know how to fix this issue. <Input itmlog> Module im_file File "/opt/bin/applogs2*.txt" SavePos TRUE ReadFromLast FALSE InputType multiline PollInterval 1 Exec if $raw_event =~ /^(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}\d{2}.\d{3})/ $EventTime = parsedate($1 + "Z"); Exec if $raw_event =~ /^.([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})|([^|])|([^|]+)|([\S\s])/ { $UUID = $1; $Plugin = $2; $Severity = $3; $Message = $4; } else if $raw_event =~ /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}[.\d] ([^|]+)|([^|]+)|([\S\s]*)/ { $Plugin = $1; $Severity = $2; $Message = $3; } else { $Message = $raw_message; } Exec $facility = 'APP_UAT'; #Exec $EventTime = strftime($EventTime, "%Y-%m-%dT%H:%M:%SZ"); Exec $Hostname = %IP%; #Exec $FullMessage = ''; </Input>

Looking for a Windows version 2.8.1248 of NXLog. I am stuck trying to remove this application from a Windows machine but a system cleanup was performed so the cache of the installer is missing. Add remove programs is requesting my .msi file to continue removing. I tried going to the downloads page and altering the URL for the latest version to include an old version but it has been removed from the website.

I am setting up NXLog Community Edition in an environment with multiple devices I want to monitor. I have already set up multiple routes of single inputs and outputs that does the job adequately, but I have a feeling I can get more complex and have less Routes to perform the same action. I have looked around the documentation and played with some prototypes but cannot find anything that works. So are any of the following ideas viable or does the Language prohibit them? Input Branching. Is it possible to route specific incoming logs to specific outputs or routes based in properties (For me it is $MessageSourceAddress)? Either by tagging the data, manipulating route data, etc. Processor Branching. Similar to #1, Is it possible to route or send logs to specific outputs based on properties (I am not sure if $MessageSourceAddress is usable in the processor or output modules). For example: Output Filtering. Is it possible to choose output destination (for me it will be a file) based on log parameters (again $MessageSourceAddress)? I think is my best option. For example: <Output Output_file> Module om_file <Exec> If $MessageSourceAddress = X.X.X.X { File '\TestLogs\Test\ test.log' … } else If $MessageSourceAddress = Y.Y.Y.Y { File '\TestLogs\Test2\ test2.log' … } else If $MessageSourceAddress = Z.Z.Z.Z { File '\TestLogs\Test3\ test3.log' … } </Exec> </Output> Thanks in advance!

I am using nx log IETF ( i.e. to_syslog_ietf() ) format to write logs. But in Wireshark (Packet Detail Window)the message is shown as following . Message [truncated]: 1 2022-08-11T10:45:38.152473+05:30 LINL190403680 NCM 0 - [NXLOG@14506 Keywords="36028797018963968" EventType="INFO" EventID="0" Version="0" Task="0" OpcodeValue="0" RecordNumber="24530" ThreadID="0" Channel="Applicati Syslog version: 1 Syslog timestamp: Aug 11, 2022 10:45:38.000000000 UTC Syslog hostname: LINL190403680 Syslog app name: NCM Syslog process id: 0 Syslog message id [truncated]: - [NXLOG@14506 Keywords="36028797018963968" EventType="INFO" EventID="0" Version="0" Task="0" OpcodeValue="0" RecordNumber="24530" ThreadID="0" Channel="Application" Opcode="Info" EventReceivedTime="2022-08- whereas using BSD format not causing this issue. Required format is shown below Priority (enclosed in < >) representing both facility and severity <30> Syslog Version: 1 Syslog timestamp: 2022-08-11T10:45:38.152473+05:30 Syslog hostname: LINL190403680 Syslog app name: NCM Syslog Process id: 0 Message identifier: Optional message specific properties (structured data) (enclosed in [ ]) : [NXLOG@14506 Keywords="36028797018963968" EventType="INFO" EventID="0" Version="0" Task="0" OpcodeValue="0" RecordNumber="24530" ThreadID="0" Channel="Application" Opcode="Info" EventReceivedTime="2022-08-11 10:45:38" SourceModuleName="ExtendedWindowsToCollect" SourceModuleType="im_msvistalog"] a human readable message (encoded in UTF-8 and starting with BOM, or ASCII 7 only bytes) : [CB-002] Application is stopped sucessfully.

There's a remote web-based app that can send syslog to an Ip/port. I've installed nxlog on my system and my current nxlog/conf/nxlog.conf file contains these lines <Input in> Module im_tcp Host 0.0.0.0 Port 1514 Exec parse_syslog(); </Input> I assume 0.0.0.0 here would mean localhost? However, the web-based app is failing to send the logs. I've pointed a sub-domain to my local machine where nxlog is installed and the web-based app is using the sub-domain to send logs to nxlogs. I'm not sure what goes in the 'host' filed in above lines? Any idea how I should go about debugging this?

Hi everybody, I upgraded my whole domain to Graylog 3.0.2284 yesterday, and decided to reboot my Graylog Server to clear all the RAM etc on it. When I restarted the Graylog Server, all the updated host got their NXLog service to "terminate unexpectedly" (info from EventID 7034, Windows Event Log). No information in the nxlog log file, and I needed to start all my services manually. What's wrong...? Thanks!

Hello, We are deploying NXLog Enterprise on a fleet of macOS devices with the goals to collect endpoint events even remotely. Which mean Graylog GELF exposed over Internet, with TLS encryption and certificate authentication requirements. I see that om_ssl can do the job of TLS communication and even client authentication, but the settings I see are using file path for the Private Key. Is there a way to have NXLog with om_ssl on macOS using a certificate from the System Keychain ? Thanks

Has anyone used JAMF to distribute this to Macs? We are rolling out NXLog to our Macs. I have the installer working, but don't have any security info to configure things like PPPC or System Extensions. I was able to manually tick the box for Full Disk Access, but I am still getting an error message saying that im_maces|in NXLog requires Transparency, Consent, and Control (TCC) approval to connect to Endpoint Security. If I can find the Bundle ID and Identifier, I should be able to roll that info a PPPC configuration profile which will flip the switch to turn on the Full Disk Access during install, so I don't have to manually do that. Then to clear the error message I am getting above, I likely need a Team Identifier and/or System Extension type for the System Extensions portion of the Configuration Profile in JAMF? But I have checked this website and don't seem to find anything here in the documentation or message boards about any identifier. Is there a way to find this info out by looking on a system that has the software installed?

Hi, We have one Oracle DB server and DBA needs to send all *.aud files from /u01/app/admin/admin/STG19/adump to remote syslog server. How do we configure nxlog file for the same Tejas Pandhare