6
responses

After a bit of trial and and lots of reading, I managed to get Graylog2 working like a charm

I'm using NXLOG to send the logs to Graylog via GELF UDP

Right now I'm just testing and trying diffrent things.

Right now I';m testing with just 4 servers (have close to 100) has consumed a fair bit of space

So to evaluate usage, I figured I'd just send the security logs (these are all Windows Servers)

Original working configuration
__________________________________________________________
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension gelf>
Module xm_gelf
</Extension>
<Input in>
# Use ’im_mseventlog’ for Windows XP, 2000 and 2003
Module im_msvistalog
# Uncomment the following to collect specific event logs only
Query <QueryList>\
<Query Id="0">\
<Select Path="System">*</Select>\
<Select Path="Application">*</Select>\
<Select Path="Security">*</Select>\
</Query>\
</QueryList>
</Input>
<Output out>
Module om_udp
Host 10.60.10.62
Port 12201
OutputType GELF
</Output>
<Route r>
Path in => out
</Route>
_______________________________________________________

Now I put a REM statement at the beginning of the file

# Just capturing security logs

The service won't start.
If I rem out Application and System path, it won't start.

Any suggestions?

AskedNovember 21, 2016 - 6:12pm

Answer (1)

Assuming by REM you mean #.

Putting that in the middle of the below query won't work:


Query <QueryList>\
<Query Id="0">\
<Select Path="System">*</Select>\
<Select Path="Application">*</Select>\
<Select Path="Security">*</Select>\
</Query>\
</QueryList>
</Input>
<Output out>

The reason is that the above is treated as a single line because the backslash at the end of each line escapes the newline characters.  I suggest using QueryXML which does not need the backslashes added to each line and you can have your XML formatted and spanning multiple lines.

Please take a look at nxlog.log. There should be an error message explaining why the service doesn't start.

 

Comments (5)

  • edberp's picture

    Yes # is my interpertation of REM

    As for the logs, 

    That was the perpelxing part, it doesn't say a damn thing 

     

    nxlog failed to start: Invalid keyword: define at C:\Program Files (x86)\nxlog\conf\nxlog.conf:1

    That was when I had a

    # This is a security log collector only 

  • edberp's picture

    \i can verify it was saved as UTF-8 the default setting in notepad, I intiallly craeted the above query using notepad++ which by default saves as utf-8 without a bom.

     

    |'m out of town but will modify the conf using notepad++ and see if that fixes it.

  • b0ti's picture
    (NXLog)

    Stock notepad doesn't add a BOM header so that should be fine. If you can attach your config (instead of pasting it) then it would be easier to tell.

  • edberp's picture

    Unless I'm blind I can't see how to attach here.

     

    I made a change to NXLOG using QueryXML instead so I can just send the security logs

     

    No errors, but no feed either

     

    efine ROOT C:\Program Files (x86)\nxlog
    Moduledir %ROOT%\modules
    CacheDir %ROOT%\data
    Pidfile %ROOT%\data\nxlog.pid
    SpoolDir %ROOT%\data
    LogFile %ROOT%\data\nxlog.log
    <Extension gelf>
    Module xm_gelf
    </Extension>
    <Input in>
    # Use ’im_mseventlog’ for Windows XP, 2000 and 2003
    Module im_msvistalog
    # Uncomment the following to collect specific event logs only
    <QueryXML>    
        <QueryList>
            <Query Id="0">
                <Select Path="Security">*</Select>    
            </Query>
        </QueryList>
    </QueryXML>    
    </Input>
    <Output out>
    Module om_udp
    Host 10.60.10.62
    Port 12900
    OutputType GELF
    </Output>
    <Route r>
    Path in => out
    </Route>