4
responses

We installed version 2.10.2150 and are using the standard out of box config file to sent syslogs to clone. Anything we can do to reduce CPU consumption? Here is our config file but I have removed IP for our clone server:

Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

<Extension _syslog>
Module xm_syslog
</Extension>

# Windows Event Log
<Input eventlog>
Module im_msvistalog
</Input>

<Output tcp>
Module om_tcp
Host xx.xx.xx.xx
Port 514
Exec to_syslog_snare();
</Output>

<Route eventlog_to_tcp>
Path eventlog => tcp
</Route>

<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>

<Extension _exec>
Module xm_exec
</Extension>

<Extension _fileop>
Module xm_fileop

# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
Every 1 hour
Exec if (file_exists('%LOGFILE%') and \
(file_size('%LOGFILE%') >= 5M)) \
file_cycle('%LOGFILE%', 8);
</Schedule>

# Rotate our log file every week on Sunday at midnight
<Schedule>
When @weekly
Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
</Schedule>
</Extension>

AskedSeptember 19, 2019 - 12:17am

Comments (4)

  • Zhengshi's picture
    (NXLog)

    I was not able to reproduce this. I tried on a VirtualBox vm running Windows 2016 Std with same config, though I swapped om_tcp for om_null.
    I am seeing 1.3%-1.8% on my test box.

    I would trim the config to see where you are seeing this issue, i.e. which module. Feel free to use im_null and om_null.

    Your im_msvistalog is unfiltered, there may be a lot of events rolling through as well.

  • cperrone's picture

    Zhengshi, thanks for your response. How do I filter im_msvistalog? I'm not a proficient coder, we really just thought we'd be able to use this out of the box with no customization. Its replacing the Snare client in our environment. When we first installed nxlog on the vCenter Management server, it used less than 2% CPU.

  • Zhengshi's picture
    (NXLog)

    No worries, I am definitely not a proficient coder either :)

    Check out the following links. These will show you how to use Query and QueryXML in combination with the NXLog language to filter out what you need.
    What you need to collect is mostly a business level decision, but the last link has a link to the Microsoft Events to Monitor section.

    https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html#im_msvistalog
    https://nxlog.co/documentation/nxlog-user-guide/reducing-bandwidth.html#reducing_filtering
    https://nxlog.co/documentation/nxlog-user-guide/windows-eventlog.html
    https://nxlog.co/documentation/nxlog-user-guide/ad-domain-controller.html

Answers (0)