1
answer

Hi All,

Is there a way to collect Netflow logs to a file and export them in Syslog format.
Trying to get a working solution to collect logs from the sd-wan device(ipfix/netflow) and forward them to our SIEM which only accepts Syslog format.
here is the conf file ..let me know what im doing wrong ?
<Extension netflow>
Module xm_netflow
</Extension>

<Extension json>
Module xm_json
</Extension>

<Input netflowIn1>
Module im_udp
Host
Port 2055
InputType netflow
</Input>

<Output Out>
Module om_file
File "c:\temp\syslog.txt"
Exec to_json();
</Output>

<Route nf>
Path netflowIn1 => Out
</Route>

AskedJuly 26, 2019 - 8:22am

Answer (1)

You should be able to add Syslog headers to your events using the xm_syslog module and the associated procedures. This is likely to be to_syslog_bsd(). See the following link for additional information.
https://nxlog.co/documentation/nxlog-user-guide/xm_syslog.html

AnsweredJuly 29, 2019 - 8:56pm

Comments (4)

  • joshik's picture

    <Extension netflow>
    Module xm_netflow
    </Extension>

    <Extension syslog>
    Module xm_syslog
    </Extension>

    <Input udpin>
    Module im_udp
    Host hostip
    Port 2055
    InputType netflow
    </Input>

    <Output out>
    Module om_file
    File "c:\temp\netflow.log"
    Exec to_syslog_bsd();
    </Output>

    <Route nf>
    Path udpin => out
    </Route>

    Tried the code from the above link..nothing happens,I see packets in Wireshark but no file created in the folder

    Any help

    August 1, 2019 - 6:40am
  • Zhengshi's picture
    (NXLog)

    Make sure the port is open for 2055/UDP on the Agent machine.
    Make sure that your netflow device is sending on UDP port 2055 to this NXLog agent.
    Check your nxlog.log file for any additional feedback.

    You can add Exec log_info($raw_event); to your udpin section to see if we are getting the data in. You would check this in the nxlog.log file.

    August 1, 2019 - 3:42pm
  • joshik's picture

    Hi, Thanks for your reply.
    I have modified the config as above but I don't have any nxlog.log file in the c:\program files\nxlog\data\ folder.

    Also worth mentioning I have been running the Wireshark on the particular IP and I can see "Destination Unreachable"

    Will send the config file as a reply to the email.

    Thanks

    August 8, 2019 - 6:48am
  • Zhengshi's picture
    (NXLog)

    Please make sure that the LogFile directive is set in your config. This will cause NXLog to write to whatever this directive is set to.

    August 8, 2019 - 11:32pm