All posts NXLog Blog

June 12, 2026

Multiline log parsing with regex: Keeping multiline events intact for your SIEM

Most telemetry pipelines treat every newline as the end of an event. That assumption holds for a tidy syslog stream but breaks the moment a Java stack trace, a Python traceback, or a pretty-printed JSON payload lands in the file. One event becomes forty lines, and your SIEM ingests forty fragments instead of one record. For a SecOps team, the cost is operational. Detection rules match on fragments or miss the event entirely, correlation loses the context that made the event worth alerting on, and the event count balloons against a volume-based license.

June 9, 2026

Announcing NXLog Platform 1.13

We are happy to announce the latest release of NXLog Platform, version 1.13. This update adds NXLog Platform operating system support for Debian 13 and NXLog Agent support for legacy 32-bit Windows. Plus, you can now use NXLog Agent with the native macOS Keychain for secure certificate storage on Apple systems. Read on for more details about these updates. Deploy NXLog Platform on Debian 13 NXLog Platform 1.13 adds support for installation on Debian 13, the latest stable release of the Debian operating system.

June 8, 2026

From blind spot to monitored: Log collection for 32-bit Windows

At NXLog, we’ve been in the log collection space long enough to know that the toughest challenges aren’t technical but political. There’s always that Windows XP machine running the ATM firmware that no one can touch. Or the Windows Server 2003 box that keeps the conveyor belt running 24/7. Then there’s the industrial SCADA system installed before smartphones existed, quietly humming along in a corner of the plant floor.

June 2, 2026

Watching the agent watch you: Telemetry for OpenClaw with NXLog

Agentic AI is now embedded across the enterprise: summarizing customer records, pulling from data warehouses, drafting on top of internal documents, calling production APIs on behalf of staff. The pitch is compelling. The reality is that you have deployed a non-deterministic process with read access to PII, trade secrets, and the business intelligence your competitors would pay for. It is a black box that reasons differently on each run, and a single misrouted tool call can move sensitive data into a context where it does not belong.

June 1, 2026

Fluent Bit vs Logstash: which pipeline fits your stack?

Fluent Bit wins on footprint. Logstash wins on parsing depth. The choice isn’t which tool is "better" — it’s where in your pipeline each one earns its keep, and what your detection tier silently misses when you put one in the wrong tier. Pick wrong and the cost shows up in three places: detection latency when batches stall, audit evidence when collectors stop shipping, and MTTR when responders can’t tell whether a quiet endpoint is an attack indicator or a broken agent.

May 28, 2026

Syslog forwarding over TLS: getting the operational layer right

Plaintext syslog crossing a network boundary in 2026 is a finding waiting to happen. The IETF defined encrypted syslog years ago in RFC 5425: TCP/6514, mutual TLS where the trust model needs it. What still trips teams up is rarely the protocol itself — it’s certificate lifecycle, framing mismatches, and forwarders that fall over when the collector blinks. Here’s the short version: which standards matter, where teams break the framing, and the four operational habits that decide whether the pipeline holds up.

May 25, 2026

Post-quantum cryptography in NXLog Agent: Post-quantum readiness for Q-Day

You have probably seen the term "post-quantum cryptography" enough times to glaze over it. The headlines tend to focus on a vague future event: a quantum computer somewhere will eventually break RSA, and at that point you should have moved on. That framing makes it easy to file PQC under "worry about it in 2030." The framing is wrong. The actual threat is happening now, and it has a name: harvest now, decrypt later.

May 20, 2026

NXLog Expands Distribution in Turkey and Emerging Markets Through Partnership with CyberDistro

Dubai, UAE, May 20, 2026 - NXLog, a leading provider of log and telemetry pipeline management solutions, today announced a distribution agreement with CyberDistro, a fast-growing global cybersecurity distributor headquartered in Istanbul and active across more than 15 countries. Through this partnership, CyberDistro will distribute and support NXLog’s vendor-agnostic telemetry pipeline platform, enabling organizations to take control of log and event data before it reaches SIEM, analytics, and other observability and security operations tools.

May 14, 2026

Network performance monitoring: metrics vs syslog logs vs traps

Every application depends on the network, yet networks are often the hardest part of the stack to diagnose when something goes wrong. Devices are up, utilization looks normal, and yet users report slowness or disconnections with no obvious cause in sight. The instinct is to rely on metrics alone: poll devices at regular intervals, watch the dashboards, set thresholds. That approach catches obvious outages, but it struggles with the harder questions: Why did latency spike when nothing looked congested?

May 7, 2026

Enterprise IIS log analysis software: top tools, use cases, and NXLog Agent integration

Ever tried to analyze IIS logs manually across dozens of web servers during a security incident? If so, you know the challenge: massive log files across multiple systems, cryptic log entries, and no easy way to correlate events. When running Microsoft Internet Information Services (IIS) across large infrastructures, log data accumulates quickly, increasing the risk of missing critical events. IIS log analysis software is designed to collect, parse, and analyze IIS web server logs to monitor activity, troubleshoot performance issues, detect threats, and demonstrate compliance.

All articles

Featured posts

Categories