All posts NXLog Blog

August 19, 2026

Announcing NXLog Platform 1.14

We are happy to announce the latest release of NXLog Platform, version 1.14. This update adds an entitlements usage summary to the NXLog Platform UI and extends NXLog Agent support to the newest Ubuntu 26.04 LTS release and Red Hat Enterprise Linux 5 for long-lived legacy deployments. Read on for more details about these updates. See data source entitlements and usage at a glance NXLog Platform 1.14 adds entitlements usage visibility to the NXLog Platform UI, giving you a clear breakdown of how your data source license is used without contacting support.

August 17, 2026

NXLog Agent 6.15 adds RHEL 5 support: log collection for the systems you can't upgrade

Some of the most critical systems in your infrastructure are also the oldest. If you operate in energy, manufacturing, or government, chances are you have hosts still running Red Hat Enterprise Linux 5 or CentOS 5. Not because anyone forgot to upgrade them, but because upgrading them is not an option. The OS is frozen by compliance requirements, tied to certified industrial equipment, or locked to software that would break on anything newer.

August 11, 2026

Free syslog server and viewer: setup, limitations, and when to upgrade

You can centralize logs from firewalls, switches, and Linux hosts with a free syslog server - rsyslog, syslog-ng OSE, and the free plan of NXLog Platform all do the job. The real differences show up in Windows support, secure transport, viewers, and what happens when your environment grows. A firewall, a switch, or an auditor says "send your logs somewhere," and there’s no budget line for it. A free syslog server solves the immediate problem in an afternoon.

August 10, 2026

Firewall log analyzer: How to centralize and analyze firewall logs

Your firewalls already record allowed and denied connections and policy changes. Each vendor logs them in its own format. This post shows you how to get those records into one searchable structure, with working configurations for the most common sources. A firewall log analyzer is a tool that collects logs from firewalls, parses each vendor’s log format into structured fields, and stores the results in one place for searching, alerting, and reporting.

August 7, 2026

Server log analysis: collection, parsing, monitoring, and troubleshooting

Server log analysis turns the raw event records your Windows and Linux servers already produce into security detections, audit evidence, and troubleshooting answers. NXLog Agent and NXLog Platform provide that pipeline: collection and parsing at the source, centralized storage and search on top. Every server you run writes down what happens to it: who logged in, which services started, what the web server returned, why a process crashed. Attackers know this too.

August 6, 2026

Sysmon event IDs: what to collect for threat detection

Sysmon fills the visibility gaps that default Windows auditing leaves open — but only if you collect the right event IDs. Here’s the complete event ID reference, my recommended collection tiers for threat detection, and working configurations for getting Sysmon data off the endpoint with NXLog Agent. Sysmon (System Monitor) is a free Microsoft tool — a Windows system service and device driver — that logs detailed system activity, such as process creation, network connections, and registry changes, to the Windows Event Log.

August 3, 2026

Surviving a region outage: multi-region disaster recovery for NXLog Platform on AWS

When a cloud region goes down, most teams think about their applications first. But if your log management platform goes dark, you lose more than a dashboard — you lose your audit trail, your security telemetry, and in many industries, your compliance posture. Every minute your ingestion endpoint is unreachable is a minute of blind spots you can’t get back. The good news: if you run NXLog Platform on AWS, building a multi-region disaster recovery (DR) setup is more straightforward than you might expect.

July 27, 2026

Log collection tools: 5 options compared for security operations

Log collection tools gather event data from endpoints, servers, network devices, and cloud services, normalize it into a consistent format, and route it to a SIEM, a database, or long-term storage. This article compares five log collection tools: NXLog Platform, Splunk Universal Forwarder, Elastic Agent, Fluent Bit, and Vector. All five move logs reliably. The factors that determine a purchase are operating system coverage, where processing happens, which destinations each tool can feed to, and whether fleet management and storage are included or have to be assembled from separate parts.

July 22, 2026

What is syslog? Ports, severity levels, and RFC 3164 vs. RFC 5424

Syslog is the standard protocol that devices, operating systems, and applications use to send event messages to a log collector. NXLog Platform collects, parses, and forwards messages in both BSD (RFC 3164) and IETF (RFC 5424) formats with a single extension. Most security telemetry still travels as syslog at some point in its life. Firewalls, switches, Linux hosts, hypervisors, and a long list of security products emit it, and every major SIEM ingests it.

July 21, 2026

5 Fluentd alternatives for security operations in 2026

The five Fluentd alternatives most worth evaluating for security operations in 2026 are NXLog Platform (collection agent, fleet management, and log storage in one product), Fluent Bit (the lightweight C collector from the same project family), Vector (a Rust pipeline built for high-volume transformation), OpenTelemetry Collector (the vendor-neutral CNCF standard), and Logstash (the Elastic Stack’s processing engine). Which one fits depends on your operating system mix, your throughput ceiling, and how many agents you need to manage.

All articles

Featured posts

Categories