All posts NXLog Blog

September 22, 2026

From journald to syslog: 4 ways to forward systemd journal logs

The major Linux distributions write their logs to the systemd journal: a binary, indexed, local-first store. However, your SIEM and collectors still expect syslog, which has been the plain text, line-oriented, network-native standard for more than four decades. If you run SecOps, you have to bridge that gap on every Linux host you monitor, and the obvious-looking switch, ForwardToSyslog=yes, moves nothing off the host by itself. Quick answer: how to forward journald to syslog?

September 21, 2026

Containerized log collection: how to capture Docker and Kubernetes logs before they disappear

Key takeaways Container logs share the container’s lifecycle. The Kubernetes documentation states that when a pod is evicted from a node, it removes the containers along with their logs. Container lifespans keep shrinking. Sysdig’s 2025 Cloud-Native Security and Usage Report found that 60% of containers live for 60 seconds or less. Collection has to be continuous, not scheduled. A node-level agent (a DaemonSet on Kubernetes) covers every container on a node without changing your applications.

September 18, 2026

Clean data: the foundation of AI-era security

The market has already answered whether telemetry is infrastructure. Cisco paid $28 billion for Splunk. Twelve days apart in 2025, CrowdStrike bought Spain’s Onum and SentinelOne moved to acquire Observo AI, both to embed AI-driven data pipelines directly beneath their platforms, while AI-native pipeline startups keep raising eight-figure rounds on the same thesis. When the largest names in security spend that kind of capital on the layer that collects, filters, and routes data, they are conceding something they rarely say out loud: detection, response, and every AI capability stacked on top are only ever as good as the pipeline underneath.

September 9, 2026

Log shipper offline buffering: how to keep logs safe when the destination goes down

Offline buffering is a log shipper’s ability to store events in memory or on disk while the destination is unreachable, then forward them automatically once the connection recovers. Without it, every SIEM outage, network partition, or agent restart becomes a permanent gap in your security telemetry. Every SIEM eventually goes down. So does the WAN link to your central collector, and eventually the host running the agent itself. None of these events should cost you log data, but whether they do depends on how your log shipper buffers when it can’t deliver data to the destination.

September 8, 2026

USB device auditing on Windows: event IDs, tools, and blocking

USB device auditing on Windows means tracking three things: when a device connects, what files move to or from it, and whether your device-control policy stopped what it was supposed to stop. Windows can record all three. Almost none of it is enabled by default. Honeywell’s 2025 Cyber Threat Report counted 1,826 unique USB-borne threats in the first quarter of 2025 alone, including 124 that were completely new. These findings came from Secure Media Exchange scanning stations at industrial sites.

September 7, 2026

WEC (Windows Event Collector) scaling limits: what breaks first, and what to do about it

A single Windows Event Collector (WEC) server has three documented scaling limits: disk write speed, concurrent WinRM connections, and registry growth from per-client bookmark data. Microsoft’s current guidance is to plan for roughly 3,000 events per second on average across all subscriptions on commodity hardware. The "10k × 10k" rule of thumb (up to 10,000 clients and 10,000 EPS per collector) still circulates widely. IBM QRadar and Juniper JSA documentation still quote it, both attributing it to Microsoft’s article.

September 4, 2026

Windows Task Scheduler event IDs: auditing scheduled task creation and abuse

Windows records scheduled task activity in two separate event logs. The Security log holds event IDs 4698-4702, covering task creation, deletion, turning on, turning off, and updates, with the full task definition XML attached. The Microsoft-Windows-TaskScheduler/Operational log holds event IDs 106, 140, and 141 for registration changes, plus 100, 200, and 201 for execution. Windows doesn’t switch on either source by default: Microsoft’s own Tarrask analysis states that "neither of these are audited by default and must be explicitly turned on by an administrator.

August 19, 2026

Announcing NXLog Platform 1.14

We are happy to announce the latest release of NXLog Platform, version 1.14. This update adds an entitlements usage summary to the NXLog Platform UI and extends NXLog Agent support to the newest Ubuntu 26.04 LTS release and Red Hat Enterprise Linux 5 for long-lived legacy deployments. Read on for more details about these updates. See data source entitlements and usage at a glance NXLog Platform 1.14 adds entitlements usage visibility to the NXLog Platform UI, giving you a clear breakdown of how your data source license is used without contacting support.

August 17, 2026

NXLog Agent 6.15 adds RHEL 5 support: log collection for the systems you can't upgrade

Some of the most critical systems in your infrastructure are also the oldest. If you operate in energy, manufacturing, or government, chances are you have hosts still running Red Hat Enterprise Linux 5 or CentOS 5. Not because anyone forgot to upgrade them, but because upgrading them is not an option. The OS is frozen by compliance requirements, tied to certified industrial equipment, or locked to software that would break on anything newer.

August 11, 2026

Free syslog server and viewer: setup, limitations, and when to upgrade

You can centralize logs from firewalls, switches, and Linux hosts with a free syslog server - rsyslog, syslog-ng OSE, and the free plan of NXLog Platform all do the job. The real differences show up in Windows support, secure transport, viewers, and what happens when your environment grows. A firewall, a switch, or an auditor says "send your logs somewhere," and there’s no budget line for it. A free syslog server solves the immediate problem in an afternoon.

All articles

Featured posts

Categories