Collecting logs from Siemens SIMATIC PCS 7 and sending them to Graylog could be a complex task because of the unique combination of the log source and the desired destination. This post seeks to explain how to forward log data from SIMATIC PCS 7 to Graylog by incorporating the NXLog log collection tool.
Siemens SIMATIC PCS 7 is a distributed control system (DCS) solution that uses a large number of Siemens hardware components supported and configured by PCS 7 software tools. Deployments usually consist of Engineering stations (ES), Operating Stations (OS), and Automation stations (AS). The PCS 7 AS comprises the Siemens SIMATIC S7-400 series central processing unit, typical use of which is the automation of plants that require a large number of I/O signals and control loops. SIMATIC PCS 7 is commonly used for various automation tasks in industrial sectors such as chemicals, petrochemicals, water treatment, pharmaceuticals and power generation.
SCADA systems and Siemens share a couple of things in common: they employ a variety of network protocols to facilitate communication between various type of nodes (physical computers, CPUs, distributed I/Os, as well as field devices) and SCADA for storing data. Consequently, both solutions are firmly integrated within the corporate networks where thosenodes are deployed.
SIMATIC PCS 7 produces a wide variety of logs about its operation. Some of the logs are available through Windows Event Log, but most of the logs are stored as flat files.
Because of the nature and size of the systems controlled by Siemens SIMATIC PCS 7, continuous and safe operation is a must with no room for errors or trade-offs. The logs produced by SIMATIC PCS 7 can provide crucial information about the operation of the entire system it controls. However, the inconsistent formatting and the noisiness of the logs could present some challenges.
NXLog Enterprise Edition is a lightweight, modular log collection tool, capable of tackling the most demanding cases log collection may pose. It possesses a wide range of features that enable it to parse almost any format to produce structured data for further processing. For these reasons, it is the perfect tool for monitoring and collecting SIMATIC PCS 7 logs.
- Collecting SIMATIC PCS 7 logs from Windows Event Log
Windows Event Log is the main log aggregation framework for the Windows platform. The logs created by SIMATIC PCS 7 contain PC station, NET configuration, and adapter operation related information, as well as information about various other services.
- Collecting SIMATIC PCS 7 logs from file
File-based PCS7 logs include WinCC system diagnostics logs, SQL Server logs of WinCC, OS project logs, AS project logs, Multiproject logs as well as Batch logs coming from Automation, Engineering, and Operator stations.
The easiest way to collect and normalize Siemens SIMATIC PCS 7 log data is to collect them with NXLog. With its unique capabilities, logs can be collected from literally any file, in any format. Given the wide variation in format and structure of such log files, its versatility is ideally suited for these systems.
For more information on how to integrate NXLog with SIMATIC PCS 7, you can find detailed documentation here.
The above mentioned log sources, and the features NXLog provides all play an important role when normalizing logs in order to be accepted by Graylog.
Graylog is a popular open source log collection tool that supports centralized log collection, data visualization, searching, and analysis. With its wide range of features, Graylog allows your security team to more effectively monitor the security of your IT infrastructure and to swiftly identify and act on security incidents.
To enable logs to be accepted by Graylog, from NXLog, you must first set up your appliance with the appropriate input source, in the Graylog web interface. This is done simply by navegating to system and then inputs. Here, you can establish if the input source is via UDP or TCP. However, if choosing to send logs over TLS (Transport Layer Security), you must configure your TLS certification file as well as your TLS private key file.
- Log sources
Setting up a generic log source in Graylog is important if you wish to send logs from a source that is not among Graylog’s list of predefined log sources. This can be achieved by sending logs to Graylog using GELF (Graylog Extended Log Format).
Forwarding logs to Graylog with NXlog is straightforward and can be accomplished by following simple configuration steps.