0
responses

hello,
Windows serveur 2019
NXLOG-CE 2.10.21.50

i have difficulties to transfert Windows 2016/2019 sercurity logs to a Syslog host.

i think that my nxlog.conf is not working right, sometimes i receive the logs some time not

can you help me please ?

###############
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _syslog>
Module xm_syslog
</Extension>

<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>

<Extension _exec>
Module xm_exec
</Extension>

<Extension _json>
Module xm_json
</Extension>
<Input in_eventlog>
# For windows 2008/vista/7/8/2012/2012R2 and latter use the following:
Module im_msvistalog

Query <QueryList> \
<Query Id="0"> \
<Select Path="Security">*[System[(EventID=1100)]]</Select> \
<Select Path="Security">*[System[(EventID=4768)]]</Select> \
<Select Path="Security">*[System[(EventID=4769)]]</Select> \
<Select Path="Security">*[System[(EventID=4771)]]</Select> \
<Select Path="Security">*[System[(EventID=4616)]]</Select> \
<Select Path="Security">*[System[(EventID=4625)]]</Select> \
<Select Path="Security">*[System[(EventID=4647)]]</Select> \
<Select Path="Security">*[System[(EventID=4648)]]</Select> \
<Select Path="Security">*[System[(EventID=4656)]]</Select> \
<Select Path="Security">*[System[(EventID=4719)]]</Select> \
<Select Path="Security">*[System[(EventID=4720)]]</Select> \
<Select Path="Security">*[System[(EventID=4722)]]</Select> \
<Select Path="Security">*[System[(EventID=4723)]]</Select> \
<Select Path="Security">*[System[(EventID=4724)]]</Select> \
<Select Path="Security">*[System[(EventID=4725)]]</Select> \
<Select Path="Security">*[System[(EventID=4726)]]</Select> \
<Select Path="Security">*[System[(EventID=4727)]]</Select> \
<Select Path="Security">*[System[(EventID=4728)]]</Select> \
<Select Path="Security">*[System[(EventID=4729)]]</Select> \
<Select Path="Security">*[System[(EventID=4730)]]</Select> \
<Select Path="Security">*[System[(EventID=4731)]]</Select> \
<Select Path="Security">*[System[(EventID=4732)]]</Select> \
<Select Path="Security">*[System[(EventID=4733)]]</Select> \
<Select Path="Security">*[System[(EventID=4734)]]</Select> \
<Select Path="Security">*[System[(EventID=4735)]]</Select> \
<Select Path="Security">*[System[(EventID=4737)]]</Select> \
<Select Path="Security">*[System[(EventID=4738)]]</Select> \
<Select Path="Security">*[System[(EventID=4739)]]</Select> \
<Select Path="Security">*[System[(EventID=4740)]]</Select> \
<Select Path="Security">*[System[(EventID=4741)]]</Select> \
<Select Path="Security">*[System[(EventID=4742)]]</Select> \
<Select Path="Security">*[System[(EventID=4743)]]</Select> \
<Select Path="Security">*[System[(EventID=4744)]]</Select> \
<Select Path="Security">*[System[(EventID=4745)]]</Select> \
<Select Path="Security">*[System[(EventID=4748)]]</Select> \
<Select Path="Security">*[System[(EventID=4749)]]</Select> \
<Select Path="Security">*[System[(EventID=4750)]]</Select> \
<Select Path="Security">*[System[(EventID=4753)]]</Select> \
<Select Path="Security">*[System[(EventID=4754)]]</Select> \
<Select Path="Security">*[System[(EventID=4755)]]</Select> \
<Select Path="Security">*[System[(EventID=4756)]]</Select> \
<Select Path="Security">*[System[(EventID=4758)]]</Select> \
<Select Path="Security">*[System[(EventID=4759)]]</Select> \
<Select Path="Security">*[System[(EventID=4760)]]</Select> \
<Select Path="Security">*[System[(EventID=4763)]]</Select> \
<Select Path="Security">*[System[(EventID=4764)]]</Select> \
<Select Path="Security">*[System[(EventID=4767)]]</Select> \
<Select Path="Security">*[System[(EventID=4778)]]</Select> \
<Select Path="Security">*[System[(EventID=4783)]]</Select> \
<Select Path="Security">*[System[(EventID=4800)]]</Select> \
<Select Path="Security">*[System[(EventID=4801)]]</Select> \
<Select Path="System">*[System[(EventID=7036)]]</Select> \
<Select Path="Application">*[System[(EventID=18454)]]</Select> \
<Select Path="Application">*[System[(EventID=18456)]]</Select> \
</Query> \
</QueryList>

Exec $Message=to_json();
# to_syslog_bsd();
# Exec $ModuleType = 'event_log';
# ReadFromLast TRUE

</Input>

<Output out_eventlog>
Module om_udp
Host xx.xx.xx.xx
#Port 514

Exec to_syslog_bsd();
</Output>

<Route eventlog>
Path in_eventlog => out_eventlog
</Route>
#####################################

AskedSeptember 21, 2020 - 2:56pm

Answers (0)