6
responses

We are using NXLog to relay logs from ModSecurity to AlienVault. The transfer is working but NXLog is adding time and date to the beginning of every line. This is stopping AlienVault from processing the data properly. Is there a way for us to stop NXLog from modifying the sent logs?

AskedMarch 29, 2019 - 9:21pm

Comments (5)

  • b0ti's picture
    (NXLog)

    nxlog does not modify the raw data unless it is explicitly told to do so, e.g. via Exec to_syslog_bsd();. It's hard to tell why without knowing what you have in your nxlog.conf .

  • Bauer3139's picture

    See below for a copy of nxlog.conf.

    ########################################
    # Global directives #
    ########################################
    User nxlog
    Group nxlog

    LogFile /var/log/nxlog/nxlog.log
    LogLevel INFO

    ########################################
    # Modules #
    ########################################
    <Extension _syslog>
    Module xm_syslog
    </Extension>

    #<Extension ModSecurity_parser>
    # Module xm_multiline
    # Headerline /---([a-zA-Z0-9]{8})---A--/
    #</Extension>

    <Input modsecurity>
    Module im_file
    File "/var/log/modsec_audit.log"
    # InputType ModSecurity_parser
    </Input>

    <Output modsecurity_logs>
    Module om_udp
    Host 10.254.16.121
    Port 514
    </Output>

    ########################################
    # Routes #
    ########################################
    <Route 1>
    Path modsecurity => modsecurity_logs
    </Route>

  • Bauer3139's picture

    Mar 29 11:39:01 ---Gbenr0sW---D--

    Above is an example line of the raw data in AlienVault and AlienVault's documentation states raw data is never modified for auditing purposes. The ModSecurity log does not have the Date and Time. It appears NXLog is adding this. The host IP is also included with the Date and Time on lines that include data.

Answer (1)

You can use the delete() procedure to delete any field in the events.
https://nxlog.co/documentation/nxlog-user-guide-full#core_proc_delete