Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [nxlog]

31 questions
0
votes
1 answer

Linux files permissions denied on log files

I have installed nxlog to send my logs to a graylog server. It works fine, but I have a denied permission on the logs of my HIDS Ossec. My process nxlog (launched by collector-sidecar) run as root : # ps -ef | grep collector root 1869 1 0…
Sorcha
  • 1,325
  • 8
  • 11
0
votes
1 answer

nxlog fails to connect, and never retries

I'm having an issue with nxlog, when trying to connect over network. It seems it is linked with misconfigured network (this is on a virtual machine, within Vagrant) Error message is ERROR couldn't connect to udp socket on 192.168.41.2:514; A socket…
Nicolas Charles
  • 725
  • 5
  • 11
0
votes
1 answer

nxlog get logs from applications and services logs

i am having issues getting data of an event log , located on the applications and services Logs. I have put a query in the nxlog conf file that get the erros,warning,critical logs from the application event log but it doesnt work. Any help would…
aymannblal
  • 1
  • 1
0
votes
1 answer

Logstash creating many tcp connections for single hosts

Logstash: 5.3.0 nxlog: nxlog-ce-2.9.1716 Checking nestat I have like 300 established connections even though I have only about 50 hosts. I have like 40 connections for some hosts when I the client's side there is only one active connection. I added…
red888
  • 4,183
  • 18
  • 64
  • 111
0
votes
1 answer

Match the SourceName set in nxlog in syslog-ng

This one is driving me a bit crazy. How do I route a message from nxlog received by syslog-ng based on the program name? It should be self explanatory but it isn't working correctly. The messages are dropped into my general log file for syslog-ng…
Tim Brigham
  • 15,545
  • 10
  • 75
  • 115
0
votes
1 answer

NxLog's 'and' Logic

I currently have NxLog running on various Domain Controllers pulling out login/logout events. Exec if $TargetUserName =~ /(\S+\$|user1|user2|user3|user4)/ drop(); \ else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID…
Eric
  • 1,383
  • 3
  • 17
  • 34
0
votes
1 answer

Nxlog - Collecting data from SQL Table

Looking to collect log information being written to a MSSQL Server table and forward it to Graylog using nxlog or similar. I see a lot of information about checking logs with nxlog but nothing related to how this could be done, does anyone know if…
ServerMonkey
  • 257
  • 4
  • 13
0
votes
1 answer

Nxlog pipe scheduled command output

I'm trying to read the output of the last command in Nxlog. I would like to run last on the utmp file on regular intervals. In other words I want to schedule a shell command to run with a time interval and pipe the output as a log event. In yet…
worldsayshi
  • 103
  • 3
0
votes
1 answer

Forwarding Application Logs using nxlog

I want to parse the Request URL field in message of application Event Logs by nxlog to kibana but i am not able to parse it as a seperate field. Please suggest what to do in it.
Arunima Agarwal
  • 11
  • 1
0
votes
1 answer

Use nxlog to parse a sophos text file and send to a syslog server

I have a windows server 2012 r2 machine with sophos. Each day there is a scan from sophos and the information is appended to the log "sav.txt". Output example (Some info changed): 20150710 205446 Using detection data version 5.16 (detection…
Patrick
  • 401
  • 3
  • 5
  • 15
0
votes
1 answer

Problems using SSL input with NXLog

TL;DR summary: NXLog won't load my certificate - why? I've set up an NXlog CE server to act as an encrypted entrypoint for a Graylog server. After creating a self-signed certificate and adding it to the configuration, I get an unexpected error in…
mhvelplund
  • 97
  • 2
  • 12
0
votes
2 answers

Forwarding Application and Services Logs using nxlog

Using nxlog 'im_mseventlog' module I'm able to forward all Windows Logs (Application, Security, System... ) logs to the remote syslog server. But I'm not able to forward eventlogs present under 'Application and Service Logs -> Microsoft -> Windows…
Arun
  • 83
  • 1
  • 3
  • 12
0
votes
1 answer

NXLog unable to read complete .csv file

I try to work out why NXLog can't read the complete .csf file witch has the same name but gets edited every 12 hours by windows for a export. conf file of NXLog: #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog Moduledir…
Alex
  • 1
  • 2
0
votes
1 answer

How can I collect Active Directory Domain Service events and DNS events with Nxlog?

My problem is I cannot collect ADDS or DNS events with Nxlog and send them to an ELK server. In the Nxlog config for the DC and DNS server I have the following Query \ \ \ …
Art.Vandelay05
  • 1,354
  • 3
  • 13
  • 27
0
votes
1 answer

NXLOG shipper and Logstash alert to NAGIOS

i am looking solution how to ship the choosen log using nxlog shipper to logstash and send alert to nagios. there is many log pattern in that file, i want to monitor this type of log like below : 2015-03-04 09:54:55.298 [178] Statistic …
user2253805
  • 51
  • 1
  • 1
  • 4
1
2
3