6
responses

Hi there, a little bit of a novice here. Hope you dont mind pointing me in the right direction.

I’m having some difficulty getting the configuration for using patternDB on windows 2003 servers, the configuration works for windows 2008+

The logs I have are as follows:

2020-02-05 13:48:32 ERROR invalid keyword: Query at C:\Program Files\nxlog\conf\nxlog.conf:40
2020-02-05 13:48:32 ERROR invalid keyword: Query at C:\Program Files\nxlog\conf\nxlog.conf:76
2020-02-05 13:48:32 ERROR module 'eventlog' has configuration errors, not adding to route '1' at C:\Program Files\nxlog\conf\nxlog.conf:57
2020-02-05 13:48:32 ERROR module 'eventlog_Pattern' has configuration errors, not adding to route 'route_Pattern' at C:\Program Files\nxlog\conf\nxlog.conf:94
2020-02-05 13:48:32 WARNING not starting unused module eventlog
2020-02-05 13:48:32 WARNING not starting unused module eventlog_Pattern
2020-02-05 13:48:32 INFO nxlog-ce-2.10.2150 started

The section of conf is:

############################################################################
####                      NXLOG WITH PATTERNDB                         #####
####    Uncomment the following lines for Windows Events filtered      #####
############################################################################

<Input internal_Pattern>
    Module      im_internal
</Input>

<Input eventlog_Pattern>
    Module      im_msvistalog
    Query       <QueryList>\
                    <Query Id="0">\
                        <Select Path="Application">*</Select>\
                        <Select Path="System">*</Select>\
                        <Select Path="Security">*</Select>\
                    </Query>\
                </QueryList>
</Input>

<Processor match_events>
     Module          pm_pattern
     PatternFile     %ROOT%\conf\patterndb.xml
</Processor>

<Output out_Pattern>
    Module      om_udp
    Host        %OUTPUT_DESTINATION_ADDRESS%
    Port        %OUTPUT_DESTINATION_PORT%
    Exec        $EventTime = integer($EventTime) / 1000000;
    Exec        if not defined $PatternID or not defined $Message { drop(); }
    Exec        $Message = to_json(); to_syslog_bsd();
</Output>

<Route route_Pattern>
    Path    eventlog_Pattern, internal_Pattern => match_events => out_Pattern
</Route>

############################################################################
#####                     /NXLOG WITH PATTERNDB                        #####
############################################################################

Thanks for reading. Please let me know if any more information needs to be included.

AskedFebruary 12, 2020 - 11:33pm

Comments (6)

  • Arkadiy's picture
    (NXLog)

    Hello,

    Unfortunately im_msvistalog won't work in this case, there is different logs pattern in old versions of Windows. We have module im_mseventlog for it, docs about it here: https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html#im_mseventlog

    Let us know, if you need more info about. Best regards, Arch

  • jaredtully's picture

    Thanks Arch

    After changing the module as per your advice, I get this in the log:

    020-02-13 12:43:20 ERROR invalid keyword: Query at C:\Program Files\nxlog\conf\nxlog.conf:70
    2020-02-13 12:43:20 ERROR module 'eventlog_Pattern' has configuration errors, not adding to route 'route_Pattern' at C:\Program Files\nxlog\conf\nxlog.conf:88
    2020-02-13 12:43:20 WARNING not starting unused module eventlog_Pattern
    2020-02-13 12:43:20 INFO nxlog-ce-2.10.2150 started
    

    I've noted another answer here that says:

    The XML Query cannot be used by im_mseventlog, see the Sources directive that is applicable here. For more sophisticated filtering you can still use drop() conditionally within the Exec directive as in any other module.

    I'm not certain how to implement these differences.

  • Arkadiy's picture
    (NXLog)

    Yes, sorry I've forget to mention that Query directive doesn't work for this module. You need to use here directive Sources if you wish to sort events on this stage.

    I think this part of your config must look something like this:

    <Input eventlog_Pattern>
        Module  im_mseventlog
        Sources Application, System, Security
    </Input>
    

    Other way to filter those records would be to use Exec directives to sort and drop any events coming from different sources. In this case this part of config will be like:

    <Input eventlog_Pattern>
        Module  im_msvistalog
        <Exec>
            if ($SourceName NOT IN (%Sources%)) drop();
        </Exec>
    </Input>
    

    They both are pretty equal so it's just a matter of taste. Please let us know about the results.

    Best regards, Arch

  • jaredtully's picture

    Appreciate that Arch.

    Still struggling here. I'll attach the full config below.

    Here are the errors:

    2020-02-13 14:27:29 ERROR Couldn't parse Exec block at C:\Program Files\nxlog\conf\nxlog.conf:65; couldn't parse statement at line 66, character 33 in C:\Program Files\nxlog\conf\nxlog.conf; syntax error, unexpected %
    2020-02-13 14:27:29 ERROR module 'eventlog_Pattern' has configuration errors, not adding to route 'route_Pattern' at C:\Program Files\nxlog\conf\nxlog.conf:85
    2020-02-13 14:27:29 WARNING not starting unused module eventlog_Pattern
    2020-02-13 14:27:29 INFO nxlog-ce-2.10.2150 started
    

    Apologies for my naivety here :D

    #
    # Configuration for converting and sending Windows logs
    # to AlienVault USM Anywhere.
    #
    # Version: 0.1.0
    # Last modification: 2019-07-03
    #
    
    define ROOT C:\Program Files\nxlog
    define OUTPUT_DESTINATION_ADDRESS x.x.x.x
    define OUTPUT_DESTINATION_PORT xxx
    
    Moduledir %ROOT%\modules
    CacheDir %ROOT%\data
    Pidfile %ROOT%\data\nxlog.pid
    SpoolDir %ROOT%\data
    LogFile %ROOT%\data\nxlog.log
    
    
    <Extension json>
        Module      xm_json
    </Extension>
    
    <Extension syslog>
        Module      xm_syslog
    </Extension>
    
    <Input internal>
        Module      im_internal
    </Input>
    
    <Input eventlog>
        Module      im_mseventlog
        Exec if ($EventID == 5156) OR ($EventID == 5158) drop();
    </Input>
    
    
    <Output out>
    
    Module      om_udp
    Host        %OUTPUT_DESTINATION_ADDRESS%
    Port        %OUTPUT_DESTINATION_PORT%
    Exec        $EventTime = integer($EventTime) / 1000000;
    Exec        $EventReceivedTime = integer($EventReceivedTime) / 1000000;
    Exec        $Message = to_json(); to_syslog_bsd();
    
    </Output>
    
    <Route 1>
    Path    eventlog, internal => out
    </Route>
    
    ############################################################################
    ####                      NXLOG WITH PATTERNDB                         #####
    ####    Uncomment the following lines for Windows Events filtered      #####
    ############################################################################
    
    <Input internal_Pattern>
        Module      im_internal
    </Input>
    
    <Input eventlog_Pattern>
        Module      im_mseventlog
        Sources Application, System, Security
        <Exec>
            if ($SourceName NOT IN (%Sources%)) drop();
        </Exec>
    </Input>
    
    <Processor match_events>
         Module          pm_pattern
         PatternFile     %ROOT%\conf\patterndb.xml
    </Processor>
    
    <Output out_Pattern>
        Module      om_udp
        Host        %OUTPUT_DESTINATION_ADDRESS%
        Port        %OUTPUT_DESTINATION_PORT%
        Exec        $EventTime = integer($EventTime) / 1000000;
        Exec        if not defined $PatternID or not defined $Message { drop(); }
        Exec        $Message = to_json(); to_syslog_bsd();
    </Output>
    
    <Route route_Pattern>
        Path    eventlog_Pattern, internal_Pattern => match_events => out_Pattern
    </Route>
    
    ############################################################################
    #####                     /NXLOG WITH PATTERNDB                        #####
    ############################################################################
    

  • Zhengshi's picture
    (NXLog)

    Looks like a define is missing.
    Try adding something like the following to your other defines:

    define Sources "Application", "System", "Security"
    

Answers (0)