Hi all,

NXLOG newbie. I'm trying to inject logs from a specific hostname into a specific folder. For example:

if hostname = x
then store log in folder = y

I'm running a very bare-bones set up. I'd like to use the FQDN as the variable for hostname rather than an IP.
Current config:

Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf\nxlog.d
define LOGDIR %ROOT%\data

define LOGFILE %LOGDIR%\nxlog.log

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

<Extension _syslog>
Module xm_syslog

<Extension _charconv>
Module xm_charconv
AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32

<Extension _exec>
Module xm_exec

<Extension _fileop>
Module xm_fileop

# Check the size of our log file hourly, rotate if larger than 5MB
Every 1 hour
Exec if (file_exists('%LOGFILE%') and \
(file_size('%LOGFILE%') >= 5M)) \
file_cycle('%LOGFILE%', 8);

# Rotate our log file every week on Sunday at midnight
When @weekly
Exec if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);

<Extension syslog>
Module xm_syslog

<Extension fileop>
Module xm_fileop

<Input udp>
Module im_udp
Port 514
Exec parse_syslog();

<Output file>
Module om_file
File "C:/Syslogs/nxlog/" + $HostName + "/" + $HostName + ".log"
CreateDir TRUE
if file_size("C:/Syslogs/nxlog/" + $HostName + "/" + $HostName + ".log") > 10M
file_cycle("C:/Syslogs/nxlog/" + $HostName + "/" + $HostName + ".log",2);

<Route 1>
Path udp => file

# Snare compatible example configuration
# Collecting event log
# <Input in>
# Module im_msvistalog
# </Input>
# Converting events to Snare format and sending them out over TCP syslog
# <Output out>
# Module om_tcp
# Host
# Port 514
# Exec to_syslog_snare();
# </Output>
# Connect input 'in' to output 'out'
# <Route 1>
# Path in => out
# </Route>

AskedJune 1, 2022 - 7:01pm

Answer (1)

Hello Sir,

You can use the following line to define a hostname variable

Exec       $Hostname = hostname();

In the case the devices are server-less you can use xm_resolver but this is available for NXLog Enterprise Edition.

Sincerely Klevin

Comments (1)