xm_admin — Remote Management (Enterprise Edition only)

Adds secure remote administration capabilities to NXLog using SOAP or JSON over HTTP/HTTPS.

xm_aixaudit — AIX Auditing (Enterprise Edition only)

Parses AIX audit events that have been written to file.

xm_asl — Apple System Logs (Enterprise Edition only)

Parses events in the Apple System Log (ASL) format.

xm_bsm — Basic Security Module Auditing (Enterprise Edition only)

Supports parsing of events written to file in Sun’s Basic Security Module (BSM) Auditing binary format.

xm_cef — CEF (Enterprise Edition only)

Provides functions for generating and parsing data in the Common Event Format (CEF) used by HP ArcSight™ products.

xm_charconv — Character Set Conversion

Provides functions and procedures to help you convert strings between different character sets (code pages).

xm_crypto — Encryption (Enterprise Edition only)

Provides encryption and decryption of logs by using data converters which implement the AES symmetric-key algorithm.

xm_csv — CSV

Provides functions and procedures to help you process data formatted as comma-separated values (CSV), and to convert CSV data into fields.

xm_exec — External Program Execution

Passes log data through a custom external program for processing, either synchronously or asynchronously.

xm_filelist — File Lists (Enterprise Edition only)

Implements file-based blacklisting or whitelisting.

xm_fileop — File Operations

Provides functions and procedures to manipulate files.

xm_gelf — GELF

Provides an output writer function which can be used to generate output in Graylog Extended Log Format (GELF) for Graylog2 or GELF compliant tools.

xm_go — Go or Golang (Enterprise Edition only)

Provides support for processing log data with methods written in the Go language.

xm_grok — Grok Patterns (Enterprise Edition only)

Provides support for parsing events with Grok patterns.

xm_java — Java (Enterprise Edition only)

Provides support for processing log data with methods written in the Java language.

xm_json — JSON

Provides functions and procedures to generate data in JSON (JavaScript Object Notation) format or to parse JSON data.

xm_kvp — Key-Value Pairs

Provides functions and procedures to parse and generate data that is formatted as key-value pairs.

xm_leef — LEEF (Enterprise Edition only)

Provides functions for parsing and generating data in the Log Event Extended Format (LEEF), which is used by IBM Security QRadar products.

xm_msdns — DNS Server Debug Log Parsing (Enterprise Edition only)

Parses Microsoft Windows DNS Server debug logs

xm_multiline — Multi-Line Message Parser

Parses log entries that span multiple lines.

xm_netflow — NetFlow (Enterprise Edition only)

Provides a parser for NetFlow payload collected over UDP.

xm_nps — NPS (Enterprise Edition only)

Provides functions and procedures for processing data in NPS Database Format stored in files by Microsoft Radius services.

xm_pattern — Pattern Matcher (Enterprise Edition only)

Applies advanced pattern matching logic to log data, which can give greater performance than normal regular expression statements. Replaces pm_pattern.

xm_perl — Perl

Processes log data using Perl.

xm_python — Python (Enterprise Edition only)

Processes log data using Python. Only versions 3.x of Python are supported.

xm_resolver — Resolver (Enterprise Edition only)

Resolves key identifiers that appear in log messages into more meaningful equivalents, including IP addresses to host names, and group/user IDs to friendly names.

xm_rewrite — Rewrite (Enterprise Edition only)

Transforms event records by modifying or discarding specific fields.

xm_ruby — Ruby (Enterprise Edition only)

Processes log data using Ruby.

xm_snmp — SNMP Traps (Enterprise Edition only)

Parses SNMPv1 and SNMPv2c trap messages.

xm_stdinpw — Passwords on standard input (Enterprise Edition only)

Reads passwords on standard input. This module has been deprecated.

xm_syslog — Syslog

Provides helpers that let you parse and output the BSD Syslog protocol as defined by RFC 3164.

xm_w3c — W3C (Enterprise Edition only)

Parses data in the W3C Extended Log File Format, the BRO format, and Microsoft Exchange Message Tracking logs.

xm_wtmp — WTMP

Provides a parser function to process binary wtmp files.

xm_xml — XML

Provides functions and procedures to process data that is formatted as XML.

xm_zlib — Compression (Enterprise Edition only)

This module compresses and decompresses log data using the gzip data format defined in RFC 1952 and the zlib format defined in RFC 1950.

im_acct — BSD/Linux Process Accounting (Enterprise Edition only)

Collects process accounting logs from a Linux or BSD kernel.

im_aixaudit — AIX Auditing (Enterprise Edition only)

Collects AIX audit events directly from the kernel.

im_azure — Azure (Enterprise Edition only)

Collects logs from Microsoft Azure applications.

im_maculs — macOS ULS (Enterprise Edition only)

Collects logs from Apple’s unified logging system (ULS) on macOS.

im_batchcompress — Batched Compression over TCP or SSL (Enterprise Edition only)

Provides a compressed network transport for incoming messages with optional SSL/TLS encryption. Pairs with the om_batchcompress output module.

im_bsm — Basic Security Module Auditing (Enterprise Edition only)

Collects audit events directly from the kernel using Sun’s Basic Security Module (BSM) Auditing API.

im_checkpoint — Check Point OPSEC (Enterprise Edition only)

Provides support for collecting logs remotely from Check Point devices over the OPSEC LEA protocol.

im_dbi — DBI

Collects log data by reading data from an SQL database using the libdbi library.

im_etw — Event Tracing for Windows (ETW) (Enterprise Edition only)

Implements ETW controller and consumer functionality in order to collect events from the ETW system.

im_exec — Program

Collects log data by executing a custom external program. The standard output of the command forms the log data.

im_file — File

Collects log data from a file on the local file system.

im_fim — File Integrity Monitoring (Enterprise Edition only)

Scans files and directories and reports detected changes.

im_go — Go or Golang (Enterprise Edition only)

Provides support for collecting log data with methods written in the Go language.

im_http — HTTP/HTTPS (Enterprise Edition only)

Accepts incoming HTTP or HTTPS connections and collects log events from client POST requests.

im_internal — Internal

Collect log messages from NXLog.

im_java — Java (Enterprise Edition only)

Provides support for processing log data with methods written in the Java language.

im_kafka — Apache Kafka (Enterprise Edition only)

Implements a consumer for collecting from a Kafka cluster.

im_kernel — Kernel (Enterprise Edition only for some platforms)

Collects log data from the kernel log buffer.

im_linuxaudit — Linux Audit System (Enterprise Edition only)

Configures and collects events from the Linux Audit System

im_mark — Mark

Outputs 'boilerplate' log data periodically to indicate that the logger is still running.

im_mseventlog — Event Logging for Windows XP/2000/2003

Collects event log messages on the Windows platform.

im_msvistalog — Windows Event Log for Windows 2008/Vista and later

Collects Windows Event Log records on the Windows platform.

im_null — Null

Acts as a dummy log input module, which generates no log data. You can use this for testing purposes.

im_oci — OCI (Enterprise Edition only)

Reads log messages from an Oracle database. This module has been deprecated.

im_odbc — ODBC (Enterprise Edition only)

Uses the ODBC API to read log messages from database tables.

im_pcap — Packet Capture (Enterprise Edition only)

Provides support to passively monitor network traffic by generating logs for various protocols.

im_perl — Perl (Enterprise Edition only)

Captures event data directly into NXLog using Perl code.

im_pipe — Named Pipes (Enterprise Edition only)

This module can be used to read log messages from named pipes on UNIX-like operating systems.

im_python — Python (Enterprise Edition only)

Captures event data directly into NXLog using Python code. Only versions 3.x of Python are supported.

im_redis — Redis (Enterprise Edition only)

Retrieves data stored in a Redis server.

im_regmon — Windows Registry Monitoring (Enterprise Edition only)

Periodically scans the Windows registry and generates event records if a change in the monitored registry entries is detected.

im_ruby — Ruby (Enterprise Edition only)

Captures event data directly into NXLog using Ruby code.

im_ssl — SSL/TLS

Collects log data over a TCP connection that is secured with Transport Layer Security (TLS) or Secure Sockets Layer (SSL).

im_systemd — Systemd (Enterprise Edition only)

This module accepts messages from the Linux systemd journal.

im_tcp — TCP

Collects log data over a TCP network connection.

im_testgen — Test Generator

Generates log data for testing purposes.

im_udp — UDP

Collects log data over a UDP network connection.

im_uds — Unix Domain Socket

Collects log data over a Unix domain socket (typically /dev/log).

im_winperfcount — Windows Performance Counters (Enterprise Edition only)

Periodically retrieves the values of the specified Windows Performance Counters to create an event record.

im_wseventing — Windows Event Forwarding (Enterprise Edition only)

Collects Windows Event Log from Windows clients that have Windows Event Forwarding configured.

im_zmq — ZeroMQ (Enterprise Edition only)

Provides incoming message transport over ZeroMQ, a scalable high-throughput messaging library.

pm_blocker — Blocker

Blocks log data from progressing through a route. You can use this module for testing purposes, to simulate when a route is blocked.

pm_buffer — Buffer

Caches messages in an in-memory or disk-based buffer before forwarding it. This module is useful in combination with UDP data inputs.

pm_evcorr — Event Correlator

Perform log actions based on relationships between events.

pm_filter — Filter

Forwards the log data only if the condition specified in the Filter module configuration evaluates to true. This module has been deprecated. Use the NXLog language drop() procedure instead.

pm_hmac — HMAC Message Integrity (Enterprise Edition only)

Protect messages with HMAC cryptographic checksumming. This module has been deprecated.

pm_hmac_check — HMAC Message Integrity Checker (Enterprise Edition only)

Check HMAC cryptographic checksums on messages. This module has been deprecated.

pm_norepeat — Message De-Duplicator

Drops messages that are identical to previously-received messages. This module has been deprecated. This functionality can be implemented with module variables.

pm_null — Null

Acts as a dummy log processing module, which does not transform the log data in any way. You can use this module for testing purposes.

pm_pattern — Pattern Matcher

Applies advanced pattern matching logic to log data, which can give greater performance than normal regular expression statements in Exec directives. This module has been deprecated. Use the xm_pattern module instead.

pm_transformer — Message Format Converter

Provides parsers for various log formats, and converts between them. This module has been deprecated. Use the xm_syslog, xm_csv, xm_json, and xm_xml modules instead.

pm_ts — Timestamping (Enterprise Edition only)

Add cryptographic Time-Stamp signatures to messages. This module has been deprecated.

om_azure — Microsoft Azure Sentinel (Enterprise Edition only)

Sends data to a Microsoft Azure Sentinel server.

om_batchcompress — Batched Compression over TCP or SSL (Enterprise Edition only)

Provides a compressed network transport for outgoing messages with optional SSL/TLS encryption. Pairs with the im_batchcompress input module.

om_blocker — Blocker

Blocks log data from being written. You can use this module for testing purposes, to simulate when a route is blocked.

om_dbi — DBI

Stores log data in an SQL database using the libdbi library.

om_elasticsearch — Elasticsearch (Enterprise Edition only)

Stores logs in an Elasticsearch server.

om_eventdb — EventDB (Enterprise Edition only)

Uses libdrizzle to insert log message data into a MySQL database with a special schema.

om_exec — Program

Writes log data to the standard input of a custom external program.

om_file — File

Writes log data to a file on the file system.

om_go — Go or Golang (Enterprise Edition only)

Provides support for forwarding log data with methods written in the Go language.

om_http — HTTP/HTTPS

Send events over HTTP or HTTPS using POST requests.

om_java — Java (Enterprise Edition only)

Provides support for processing log data with methods written in the Java language.

om_kafka — Apache Kafka (Enterprise Edition only)

Implements a producer for publishing to a Kafka cluster.

om_null — Null

Acts as a dummy log output module. The output is not written or sent anywhere. You can use this module for testing purposes.

om_oci — OCI (Enterprise Edition only)

Writes log messages to an Oracle database. This module has been deprecated.

om_odbc — ODBC (Enterprise Edition only)

Uses the ODBC API to write log messages to database tables.

om_perl — Perl (Enterprise Edition only)

Uses Perl code to handle output log messages from NXLog.

om_pipe — Named Pipes (Enterprise Edition only)

This module allows log messages to be sent to named pipes on UNIX-like operating systems.

om_python — Python (Enterprise Edition only)

Uses Python code to handle output log messages from NXLog. Only versions 3.x of Python are supported.

om_raijin — Raijin (Enterprise Edition only)

Stores log messages in a Raijin server.

om_redis — Redis (Enterprise Edition only)

Stores log messages in a Redis server.

om_ruby — Ruby (Enterprise Edition only)

Uses Ruby code to handle output log messages from NXLog.

om_ssl — SSL/TLS

Sends log data over a TCP connection that is secured with Transport Layer Security (TLS) or Secure Sockets Layer (SSL).

om_tcp — TCP

Sends log data over a TCP connection to a remote host.

om_udp — UDP

Sends log data over a UDP connection to a remote host.

om_udpspoof — UDP with IP Spoofing (Enterprise Edition only)

Sends log data over a UDP connection, and spoofs the source IP address to make packets appear as if they were sent from another host.

om_uds — UDS

Sends log data to a Unix domain socket.

om_webhdfs — WebHDFS (Enterprise Edition only)

Stores log data in Hadoop HDFS using the WebHDFS protocol.

om_zmq — ZeroMQ (Enterprise Edition only)

Provides outgoing message transport over ZeroMQ, a scalable high-throughput messaging library.

im_acct

im_aixaudit

im_azure

im_batchcompress

im_bsm

im_checkpoint

im_dbi

im_etw

im_exec

im_file

im_fim

im_go

im_http

im_internal

im_java

im_kafka

im_kernel

im_linuxaudit

im_maces

im_maculs

im_mark

im_mseventlog

im_msvistalog

im_null

im_odbc

im_pcap

im_perl

im_pipe

im_python

im_redis

im_regmon

im_ruby

im_ssl

im_systemd

im_tcp

im_testgen

im_udp

im_uds

im_winperfcount

im_wseventing

im_zmq

om_azure

om_batchcompress

om_blocker

om_dbi

om_elasticsearch

om_eventdb

om_exec

om_file

om_go

om_http

om_java

om_kafka

om_null

om_odbc

om_perl

om_pipe

om_python

om_raijin

om_redis

om_ruby

om_ssl

om_tcp

om_udp

om_udpspoof

om_uds

om_webhdfs

om_zmq

[[modules_by_package_java/jni/libjavanxlog]]java/jni/libjavanxlog

xm_admin

xm_aixaudit

xm_asl

xm_bsm

xm_cef

xm_charconv

xm_crypto

xm_csv

xm_exec

xm_filelist

xm_fileop

xm_gelf

xm_go

xm_grok

xm_java

xm_json

xm_kvp

xm_leef

xm_msdns

xm_multiline

xm_netflow

xm_nps

xm_pattern

xm_perl

xm_python

xm_resolver

xm_rewrite

xm_ruby

xm_snmp

xm_soapadmin

xm_syslog

xm_w3c

xm_wtmp

xm_xml

xm_zlib

pm_blocker

pm_buffer

pm_evcorr

pm_filter

pm_hmac

pm_hmac_check

pm_norepeat

pm_null

pm_pattern

pm_transformer

pm_ts