Windows Nxlog conf tips and tricks!

This support forum board is for support questions relating to Nagios Log Server, our solution for managing and monitoring critical log data.
Locked
krobertson71
Posts: 444
Joined: Tue Feb 11, 2014 10:16 pm

Windows Nxlog conf tips and tricks!

Post by krobertson71 »

Just wanted to share my little finds as I come across them. I have been combing the interwebs looking for material on Nxlog configs. Been testing a few things and wanted to share this particular one.

By default, the config in Nagios Log Server for nxlog grabs all Windows logs. But, for arguments sake, you only wanted to collect just the Application and/or System logs, or just Security Logs..etc...

Well here is how you do that.

Just add this little nugget under the tag <Input Eventlog> tag and directly beneath "Module im_msvistalog". Full log also posted below for full effect.

Code: Select all

Query    <QueryList>\
                   <Query Id="0">\
                     <Select Path="System">*</Select>\
		      <Select Path="Application">*</Select>\
                    </Query>\
        </QueryList> 

Full nxlog.conf

Code: Select all

## See the nxlog reference manual at 
## http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
 
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERT %ROOT%\cert
 
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
 
# Include fileop while debugging, also enable in the output module below
#<Extension fileop>
#    Module xm_fileop
#</Extension>
 
<Extension json>
    Module      xm_json
</Extension>
 
<Extension syslog>
    Module xm_syslog
</Extension>
 
<Input internal>
    Module im_internal
</Input>
 
# Watch your own files
<Input file1>
    Module   im_file
    File     '%ROOT%\data\nxlog.log'
    SavePos  TRUE
</Input>
 
# Windows Event Log
<Input eventlog>
# Uncomment im_msvistalog for Windows Vista/2008 and later
    Module im_msvistalog
# Custom query config to only pull the System and Application logs, excluding the Security log.
	Query    <QueryList>\
                   <Query Id="0">\
                     <Select Path="System">*</Select>\
		      <Select Path="Application">*</Select>\
                    </Query>\
        </QueryList> 
	
	


# Uncomment im_mseventlog for Windows XP/2000/2003
#   Module im_mseventlog
</Input>

<Output out>
    Module om_tcp
    Host 192.168.0.20
    Port 3515
	
    Exec  $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message");
    Exec  $raw_event = to_json();
	
	# Uncomment for debug output
	# Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n");
</Output>
 
<Route 1>
    Path internal, file1, eventlog => out
</Route>
tmcdonald
Posts: 9117
Joined: Mon Sep 23, 2013 8:40 am

Re: Windows Nxlog conf tips and tricks!

Post by tmcdonald »

Thank you! NLS is a very new product, so things like this are always welcome. Bugs, suggestions, comments, and concerns too.
Former Nagios employee
Locked