- OS Support
- Enterprise Edition Reference Manual
- 129. Man Pages
- 130. Configuration
- 131. Language
- 132. Extension Modules
- 133. Input Modules
- 134. Processor Modules
- 135. Output Modules
- 135.1. Batched Compression (om_batchcompress)
- 135.2. Blocker (om_blocker)
- 135.3. DBI (om_dbi)
- 135.4. Elasticsearch (om_elasticsearch)
- 135.5. EventDB (om_eventdb)
- 135.6. Program (om_exec)
- 135.7. Files (om_file)
- 135.8. Go (om_go)
- 135.9. HTTP(s) (om_http)
- 135.10. Java (om_java)
- 135.11. Kafka (om_kafka)
- 135.12. Null (om_null)
- 135.13. ODBC (om_odbc)
- 135.14. Perl (om_perl)
- 135.15. Named Pipes (om_pipe)
- 135.16. Python (om_python)
- 135.17. Raijin (om_raijin)
- 135.18. Redis (om_redis)
- 135.19. Ruby (om_ruby)
- 135.20. Microsoft Azure Sentinel (om_sentinel)
- 135.21. TLS/SSL (om_ssl)
- 135.22. TCP (om_tcp)
- 135.23. UDP (om_udp)
- 135.24. UDP with IP Spoofing (om_udpspoof)
- 135.25. Unix Domain Sockets (om_uds)
- 135.26. WebHDFS (om_webhdfs)
- 135.27. ZeroMQ (om_zmq)
- NXLog Manager
- NXLog Add-Ons
This module allows logs to be stored in an Microsoft Azure Sentinel server. It will connect to the URL specified in the configuration in either plain HTTP or HTTPS mode. Event data is sent in batches, reducing the latency caused by the HTTP responses, thus improving Microsoft Azure Sentinel server performance.
Starting with NXLog version 5.2, this module takes advantage of an internal batch processing mechanism which is provided by the NXLog core.
Internal batching works by accumulating multiple successive event records produced by an input or processor module into a batch of records. When a batch is full or after a configurable timeout expires, the batch is forwarded to the next module in the route. For it’s own batching functionality, the om_sentinel module now uses the already available batches it receives from the previous module, instead of reorganizing individual event records into batches itself.
Simply put, the new batching functionality works the same as before, with the difference that event records are organized into batches by input and processor modules, whereas in older versions, it was the output modules which did this. Because of this, the FlushInterval and FlushLimit configuration directives have been deprecated for om_sentinel. The same functionality is now provided by the BatchFlushInterval and BatchSize directives, which can be used with all input and processor module(s).
|To examine the supported platforms, see the list of installer packages in the Available Modules chapter.|
This mandatory directive specifies the name of Custom Table to which module will be sending log messages. Azure automatically appends
_CLto all Custom Tables thus the table will appear as
TableName_CLin the list of Custom Tables. It must be a string type expression. If the expression in the
TableNamedirective is not a constant string (it contains functions, field names, or operators), it will be evaluated for each event.
This mandatory directive specifies the Workspace ID of the Microsoft Azure Sentinel.
This mandatory directive specifies the URL for the module to POST the event data. If multiple URL directives are specified on new lines, the module works in a failover configuration. If a destination becomes unavailable, the module automatically fails over to the next one. If the last destination becomes unavailable, the module fails over to the first destination.
The module operates in plain HTTP or HTTPS mode depending on the URL provided. If the port number is not explicitly defined in the URL, it defaults to port 80 for HTTP and port 443 for HTTPS.
This optional directive specifies an additional header to be added to each HTTP request.
This boolean directive specifies that the connection should be allowed without certificate verification. If set to TRUE, the connection will be allowed even if the remote HTTPS server presents an unknown or self-signed certificate. The default value is FALSE: the remote HTTPS server must present a trusted certificate.
This specifies the path to a directory containing certificate authority (CA) certificates, which will be used to check the certificate of the remote HTTPS server. The certificate filenames in this directory must be in the OpenSSL hashed format. A remote’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.
This specifies the path of the certificate authority (CA) certificate, which will be used to check the certificate of the remote HTTPS server. To trust a self-signed certificate presented by the remote (which is not signed by a CA), provide that certificate instead.
This optional directive specifies the certificate thumbprint of the certificate authority (CA), which is used to look up the CA certificate from the Windows certificate store. The hexadecimal fingerprint string can be copied straight from Windows Certificate Manager (certmgr.msc), whitespaces are automatically removed. This directive is only supported on Windows. This directive and the HTTPSCADir and HTTPSCAFile directives are mutually exclusive.
This specifies the path of the certificate file to be used for the HTTPS handshake.
This specifies the path of the certificate key file to be used for the HTTPS handshake.
This optional directive specifies the certificate thumbprint to be used for the SSL handshake. The hexadecimal fingerprint string can be copied straight from Windows Certificate Manager (certmgr.msc), whitespaces are automatically removed. This directive is only supported on Windows. This directive and the HTTPSCertFile and HTTPSCertKeyFile directives are mutually exclusive.
This specifies the path to a directory containing certificate revocation lists (CRLs), which will be consulted when checking the certificate of the remote HTTPS server. The certificate filenames in this directory must be in the OpenSSL hashed format.
This specifies the path of the certificate revocation list (CRL) which will be consulted when checking the certificate of the remote HTTPS server.
With this directive, a password can be supplied for the certificate key file defined in HTTPSCertKeyFile. This directive is not needed for passwordless private keys.
This optional directive can be used to set the permitted SSL cipher list, overriding the default. Use the format described in the ciphers(1ssl) man page.
This optional directive can be used to define the permitted SSL cipher list in case the HTTPSSSLProtocol directive is set to
TLSv1.3. Use the same format as in the HTTPSSSLCipher directive.
This boolean directive allows you to enable data compression when sending data over the network. The compression mechanism is based on the zlib compression library. If the directive is not specified, it defaults to FALSE (the compression is disabled).Note
Some Linux packages (for example, Debian) use the OpenSSL library provided by the OS and may not support the zlib compression mechanism. The module will emit a warning on startup if the compression support is missing. The generic deb/rpm packages are bundled with a zlib-enabled libssl library.
This directive can be used to set the allowed SSL/TLS protocol(s). It takes a comma-separated list of values which can be any of the following:
TLSv1.3. By default, the
TLSv1.3protocols are allowed. Note that the OpenSSL library shipped by Linux distributions may not support
SSLv3, and these will not work even if enabled with this directive.
This optional directive is used to specify the IP address (or hostname) and port number of the HTTP proxy server to be used. The format is
hostname:port. If the port number is ommited, it defaults to 80.Note
The om_sentinel module supports HTTP proxying only. SOCKS4/SOCKS5 proxying is not supported.
This optional directive sets the reconnect interval in seconds. If it is set, the module attempts to reconnect in every defined second. If it is not set, the reconnect interval will start at 1 second and doubles on every attempt. If the duration of the successful connection is greater than the current reconnect interval, then the reconnect interval will be reset to 1 sec.
The following procedures are exported by om_sentinel.
Force a reconnection. This can be used from a Schedule block to periodically reconnect to the server.
This configuration reads log messages from file and forwards them via HTTPS.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 <Input file> Module im_file File 'log.txt' SavePos FALSE ReadFromLast FALSE BatchSize 1000 BatchFlushInterval 3 </Input> define WORKSPACE 8c70dfcb-83e1-4959-934d-fcb4860bf1de define SHAREDKEY LaclX2gpa94zeqdnVo+URKFrMJ8s9husTGssN9xwjoJgGA9kEF3Jra0XIedOpJC80uzTGz2LVZRuUYEqI4mRVA== define SUBDOMAIN ods.opinsights.azure.com define RESOURCE api/logs define APIVER api-version=2016-04-01 <Output sentinel> Module om_sentinel URL https://%WORKSPACE%.%SUBDOMAIN%/%RESOURCE%?%APIVER% WorkspaceID %WORKSPACE% SharedKey %SHAREDKEY% TableName "testImFileNative_dir" HTTPSCAFile /etc/ssl/certs/ca-bundle.crt LocalPort 1500 Reconnect 2 AddHeader TestHeader : test-value <Exec> add_http_header('Test-header', 'test_value'); </Exec> <Schedule> Every 10 min Exec reconnect(); </Schedule> </Output>