Hello, I´m trying to send logs from my windows server to my SIEM in XML format, but same logs are too long and i see 2 logs instead of just one. <Input windows> Module im_msvistalog <QueryXML> <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*</Select> <Suppress Path="Security">*[System[(EventID=4663 or EventID=4690 or EventID=4658 or EventID=4656)]]</Suppress> </Query> </QueryList> </QueryXML> </Input> # <Output siem> Module om_tcp Host xxx.xxx.xxx.xxx Port 514 Exec to_xml(); </Output> # # Connect input 'in' to output 'out' <Route 1> Path windows => siem </Route> Can anyone help me?Thanks

Can anyone tell me for certain if this module is only included in the Enterprise version? If so, where does one buy the Enterprise Version and what is it's approximate cost? (USD)

Hello Team,I am new to nxlog and i have a requirement to collect windows logs from 2003 servers and the agent version that i am using is “nxlog-ce-2.11.2190”As per the documnet i have used im_mseventlog module, but still getting error and not able to pull the logs from 2003 servers. If some one please share me the config file for 2003 servers would be a great help below is the error that we are getting when starting the nxlog service.2022-12-21 09:37:50 WARNING nxlog-ce received a termination request signal, exiting...2022-12-21 09:37:51 ERROR invalid keyword: QueryXML at C:\Program Files\nxlog\conf\nxlog.conf:272022-12-21 09:37:51 ERROR module 'eventlog' has configuration errors, not adding to route '1' at C:\Program Files\nxlog\conf\nxlog.conf:592022-12-21 09:37:51 ERROR route 1 is not functional without input modules, ignored at C:\Program Files\nxlog\conf\nxlog.conf:592022-12-21 09:37:51 WARNING no routes defined!2022-12-21 09:37:51 WARNING not starting unused module eventlog2022-12-21 09:37:51 WARNING not starting unused module syslogout2022-12-21 09:37:51 INFO nxlog-ce-2.11.2190 started my config file.#NoFreeOnExit TRUE define ROOT     C:\Program Files\nxlogdefine CERTDIR  %ROOT%\certdefine CONFDIR  %ROOT%\confdefine LOGDIR   %ROOT%\datadefine LOGFILE  %LOGDIR%\nxlog.logLogFile %LOGFILE% Moduledir %ROOT%\modulesCacheDir  %ROOT%\dataPidfile   %ROOT%\data\nxlog.pidSpoolDir  %ROOT%\data <Extension _syslog>    Module      xm_syslog</Extension> ############INPUTS######## <Input eventlog> Module im_mseventlog <QueryXML><QueryList><Query Id="0"><Select Path="Security">*</Select></Query></QueryList></QueryXML></Input> #<Processor eventlog_transformer>#Module pm_transformer#</Processor> #<Processor buffer>#Module pm_buffer#MaxSize 102400#Type disk#</Processor> <Output syslogout>#Module om_udpModule om_tcpHost syslogipPort 514 Exec to_syslog_snare(); </Output> #<Route 1> #Path eventlog => eventlog_transformer => syslogout #</Route> <Route 1> Path eventlog => syslogout </Route>

Hello,My current architecture is a windows nxlog agent sending logs to a remote syslog server. The agent is translating Windows event logs to json encapsulated syslog before sending them.I've encountered an inconsistency with the hostname field of the sent log, most of the sent logs contain the hostname as expected, but some only contains the IP address which creates a mess on the sorting I made on the remote syslog server.I haven't tried anything yet as I don't really know where to look for. My take is that it is a windows event log issue that can't be fixed but i'd like your opinions.Thank you for your help.

I'm sending im_msvistalog messages to splunk via to_json().  I'm ending up with a field AccessList like:AccessList: %%4423which I assume is some kind of mapping of:Access Request Information: Accesses: ReadAttributesfrom the “Message” component.  Is that right?  If so, it's fairly obscure.  Is there some way to preserve “Accesses” as is?  What is “AccessList” trying to tell me?  Is there somewhere I can go to decode it?

Hello team,How to get NXLog Manager license?Thank you Klevin

HiIs it possible to install nxlog-ce-3.1.2319.msi on Windows 2008 R2?Regards.

TEST

Hi, Doing my first steps with NXlog.I have managed to collect all “Security” windows event log and also managed to update the “Version” parameter to my own parameter - Just for a test purposes Now I need to perform 3 tasks Collect all “Security” windows event log - DoneUpdate the “Version” parameter from int to string - Done Update the “Hostname” parameter of specific event ID (for example EventID":4656) to “test”  - Please advice Thank you <Input eventlog>   Module  im_msvistalog   <QueryXML>       <QueryList>           <Query Id='0'>    <Select Path='Security'>*</Select>           </Query>       </QueryList>   </QueryXML><Exec>       $Hostname = "test" ;      # This task should be only for eventID 4656       $Version = string($Version);       to_json();   </Exec></Input> 

I am trying to use the example in https://docs.nxlog.co/ce/current/index.html#om_file for file rotation on Windows (nxlog-ce-3.1.2319).I receive the following errorERROR Couldn't parse Exec block at xxx.conf:104; couldn't parse statement at line 107, character 29 in xxx.conf; module file not found ERROR module 'testfile' has configuration errorsusing this configuration.   The output works fine if I don't use the functions,  so I assume om_file must be loading (by default?).<Output testfile> Module om_file File "E:/nxlog_output/active/nxlog-out.txt" <Exec> # Format output to_json(); # Rotate file based on size, move to staging folder if (file-&gt;file_size() &gt; 10M) { $stagingFolder = 'E:/nxlog_output/staged/'; $newfile = $stagingFolder + 'data_' + strftime(now(), '%Y%m%d%H%M%S') + '.log'; file-&gt;rotate_to($newfile); } &lt;/Exec&gt; </Output> 

Apologies if I'm being dense, but I need some help with navigation of this site.The upper-right search box on this page, (https://nxlog.co/community-forum/) never submits.   Is there another search function I can use?Google search results all point to URLs like https://nxlog.co/question/4970/iis-logs-containing-quotes-are-not-processing,  which return a 404 when I click through.

Hi,I have installed nxlog service (nxlog-ce-3.1.2319.msi) on windows core 2019 machine. I have a config:define EVENT_REGEX /^.*(<EventData>.+<\/EventData>)$/ <Extension xml> Module xm_xml </Extension> <Extension json> Module xm_json </Extension> <Input k8s_containers> Module im_file File "c:\var\log\containers*.log" <Exec> if $raw_event =~ %EVENT_REGEX% { parse_xml($1); } else { drop(); } $log_type = "k8s_container"; $hostname = hostname(); $host_ip = host_ip(); $log_file = file_name(); if $log_file =~ /(.+)_(.+)_(.+)-(.+).log$/ { $k8s_pod = $1; $k8s_namespace = $2; $k8s_container = $3; $k8s_container_id = $4; } to_json(); &lt;/Exec&gt; </Input> <Output file> Module om_file File "c:\k\nxlog.log" </Output> <Route containerlog> Path k8s_containers => file </Route>Everythings work fine, but log line has “log_file”: “unknown”. And because of that I didn't get $k8s_* fields.How should I debug/resolv this issue?

Does nxlog community edition support IBM AIX & SUN Solaris?

Is there a combination of inputs and extensions that can be used to collect RADIUS accounting messages via UDP listener? We use Microsoft NPS today, but could benefit from the forking and advanced parsing of NXLog. We send RADIUS accounting messages from multiple network devices and the differences in data layout are bit too much for NPS.

Forgive my ignorance but I'm looking to use NX Log to capture all windows events under System, Application and Security whether they be Audit, Info, error or critical. Am I correct in my assumption that with no filter's it should collect everything? <Select Path='Application'></Select> <Select Path='Security'></Select> <Select Path='System'></Select> or do I need to specify on single lines each severity level? for example: <Select Path='Application'>[System/Level=4]</Select> <Select Path='Application'>[System/Level=3]</Select> <Select Path='Application'>[System/Level=2]</Select> and so on?

Hi guys, We have NXLog CE 3.0.2272 installed on a server which was originally installed by another user manually. We have tried uninstalling it via the uninstall string MsiExec.exe /X {xxxxx} via ConnectWise which appeared to have uninstalled ok. Since then, we have installed a newer CE version 3.1.2319 however after installation the nxlog service is non-existent. We suspect the uninstallation via string may have broken this. Several attempts using the original installer to repair or uninstall/reboots does not fix this. Is there a way we can start fresh to remove NXLog completely then install? Any help would be appreciated :) TIA Jordan

Hellow everyone! I have a scenario that uses Citrix MCS where I installed the agent on the master image that provides clone images that should go with the nxlog agent installed and running. But the agent goes up with some errors as below: 2022-09-23 13:51:38 ERROR couldn't connect to udp socket on <IP:XYZ:514>; The socket operation was attempted to an unreachable network. 2022-09-23 13:51:46 WARNING Due to the limitation in the Windows EventLog subsystem, the query cannot contain more than 256 sources. 2022-09-23 13:51:46 WARNING The following sources are omitted to avoid exceeding the limit in the generated query: Setup WitnessClientAdmin 2022-09-23 13:52:14 WARNING received a system shutdown request 2022-09-23 13:52:14 WARNING stopping nxlog service 2022-09-23 13:52:14 WARNING nxlog-ce received a termination request signal, exiting... 2022-11-02 23:16:38 INFO nxlog-ce-2.11.2190 started 2022-11-02 23:16:44 WARNING Due to the limitation in the Windows EventLog subsystem, the query cannot contain more than 256 sources. 2022-11-02 23:16:44 WARNING The following sources are omitted to avoid exceeding the limit in the generated query: Setup WitnessClientAdmin 2022-11-02 23:27:15 ERROR EvtNext failed with error 15007: The specified channel could not be found. Check channel configuration. 2022-11-02 23:27:16 WARNING Due to the limitation in the Windows EventLog subsystem, the query cannot contain more than 256 sources. 2022-11-02 23:27:16 WARNING The following sources are omitted to avoid exceeding the limit in the generated query: WitnessClientAdmin 2022-11-02 23:27:16 ERROR Failed to retrieve eventlog fields; The handle is invalid. Has anyone had a problem like this using Citrix MCS? Thanks James \0/

Hello! We have permanent memory leaks on Windows Event Collect server with any 5 version NXLog. If we install any 4 version - it work without memory leak, but very slowly - it's accumulating queue on single filter for windows events. How we can help to fix it in next release?

Hi, I use NXLog to send log of an Oracle Database to Graylog. When i send the log to a INPUT in Graylog, the logs in Graylog are not in the same order as the source logfile. I have configured an output to send event in an other logfile and in the new log the event are ine the same order as the source logfile. Configuration to the UDP Output Graylog where the event are not in the same order as the source logfile. <Extension gelf> Module xm_gelf ShortMessageLength 200 </Extension> <Input ora-database-rman> Module im_file File "/oracle/rman/logs/DATABASE_*.log" </Input> <Output ext-graylog> Module om_udp Host XX.XX.XX.XX Port XXXXX OutputType GELF_UDP </Output> <Route database-rman Path ora-database-rman => ext-graylog </Route> Configuration to the om_file module loca where the event are in the same order as the source logfile. <Input ora-database-rman> Module im_file File "/oracle/rman/logs/DATABASE_*.log" Exec sleep(100); </Input> <Output fileout> File 'tmp/output' Module om_file </Output> <Route database-rman Path ora-database-rman => fileout </Route> Do you have an idea how to get the event in the order to the OUTPUT TCP ? Thanks for your help, Matt

Hello all, I have an application that sends log files to a directory formatted at YYYY-MM-DD.log (year, month, day). I'm watching the directory with the following stanza in the configuration file, but it does not recognize when the date changes and a new file is created. A service restart gets it reading the new file. The configuration is as follows: <Input cvdupdate> Module im_file File "/var/log/cvdupdate/*.log" </Input> I'm running NXLog on a Ubuntu 18.04 system. The version is 3.0.2272.