nxlog

[idas]

Hello,

I am new to Nagios Log server and i am trying to send logs from Windows to Nagios Log Server.
I managed to do so from other network devices, but couldn't from any windows PC.

my nxlog.conf is:
===============================================================================
define ROOT C:\Program Files (x86)\nxlog
define CERT %ROOT%\cert

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension json>
Module xm_json
</Extension>

<Extension syslog>
Module xm_syslog
</Extension>

<Input internal>
Module im_internal
</Input>

# Watch your own files
<Input file1>
Module im_file
File '%ROOT%\data\nxlog.log'
SavePos TRUE
Exec $Message = $raw_event;
</Input>

# Windows Event Log
<Input eventlog>
# Uncomment im_msvistalog for Windows Vista/2008 and later
Module im_msvistalog
</Input>

<Output out>
Module om_tcp
Host 172.22.1.40
Port 3515

Exec $tmpmessage = $Message; delete($Message); rename_field("tmpmessage","message");
Exec $raw_event = to_json();

# Uncomment for debug output
# Exec file_write('%ROOT%\data\nxlog_output.log', $raw_event + "\n");
</Output>

<Route 1>
Path internal, file1, eventlog => out
</Route>
================================================================================


The only type of logs that i receive at dashboard is like these:

2016-04-15T09:26:32.582+03:00 172.22.1.136 eventlog 2016-04-15 09:23:19 ERROR couldn't connect to tcp socket on 172.22.1.40:3515; No connection could be made because the target machine actively refused it.
2016-04-15T09:26:32.582+03:00 172.22.1.136 eventlog 2016-04-15 09:26:39 INFO connecting to 172.22.1.40:3515
2016-04-15T09:26:32.581+03:00 172.22.1.136 eventlog 2016-04-15 09:23:18 INFO connecting to 172.22.1.40:3515
2016-04-15T09:26:32.581+03:00 172.22.1.136 eventlog 2016-04-15 09:23:19 INFO reconnecting in 200 seconds
2016-04-15T09:26:32.570+03:00 172.22.1.136 eventlog 2016-04-15 09:19:58 INFO reconnecting in 200 seconds
2016-04-15T09:26:32.570+03:00 172.22.1.136 eventlog 2016-04-15 09:19:58 ERROR couldn't connect to tcp socket on 172.22.1.40:3515; A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because c...
2016-04-15T09:26:32.569+03:00 172.22.1.136 eventlog 2016-04-15 09:19:37 INFO connecting to 172.22.1.40:3515
================================================================================

Please propose a solution.
Regards,
John

[rkennedy]

Looks like you're using the standard NXLog configuration, and it's working fine. The issue is, that their is probably still a firewall in play on port 3515 on NLS.

Try running these commands, and check back to your logs once again -

Code: Select all

iptables -I INPUT -p tcp --destination-port 3515 -j ACCEPT 
iptables -I INPUT -p udp --destination-port 3515 -j ACCEPT
service iptables save 

Let us know if that helps.

[idas]

Hello rkennedy,

Thank you for the reply.
I added the iptables rules but i still face the issue.
I only received the following eventlogs:
-----------------------------------------------------------------
2016-04-18T11:03:02.216+03:00 172.22.1.136 eventlog 2016-04-18 11:03:35 ERROR Couldn't read next event, corrupted eventlog?; The data is invalid.
2016-04-18T11:03:02.023+03:00 172.22.1.136 eventlog Couldn't read next event, corrupted eventlog?
The data is invalid.
2016-04-18T11:02:57.219+03:00 172.22.1.136 eventlog 2016-04-18 11:03:29 INFO connecting to 172.22.1.40:3515
2016-04-18T11:02:57.218+03:00 172.22.1.136 eventlog 2016-04-18 11:03:29 INFO nxlog-ce-2.9.1504 started
2016-04-18T11:02:56.205+03:00 172.22.1.136 eventlog connecting to 172.22.1.40:3515
2016-04-18T11:02:56.205+03:00 172.22.1.136 eventlog 2016-04-18 11:03:28 WARNING nxlog-ce received a termination request signal, exiting...
2016-04-18T11:02:56.205+03:00 172.22.1.136 eventlog nxlog-ce-2.9.1504 started
2016-04-18T11:02:56.204+03:00 172.22.1.136 eventlog 2016-04-18 11:03:28 WARNING stopping nxlog service
2016-04-18T11:02:54.802+03:00 172.22.1.136 eventlog nxlog-ce received a termination request signal, exiting...
2016-04-18T11:02:54.801+03:00 172.22.1.136 eventlog stopping nxlog service
--------------------------------------------------------------------

I even tried to change the input of the nxlog.conf to something more specific

<Input eventlog>
Module im_msvistalog
Query <QueryList> \
<Query Id="0"> \
<Select Path="Microsoft-Windows-Sysmon/Operational">*</Select> \
<Select Path="Application">*</Select> \
<Select Path="System">*</Select> \
<Select Path="Security">*</Select> \
</Query> \
</QueryList>
</Input>

But still i couldn't receive any meaningful log from the PC... only the following ones
---------------------------------------------------------------------------------------------------
2016-04-18T11:01:58.698+03:00 172.22.1.136 eventlog
2016-04-18T11:01:58.523+03:00 172.22.1.136 eventlog
2016-04-18T11:01:58.365+03:00 172.22.1.136 eventlog
2016-04-18T10:58:42.649+03:00 172.22.1.136 eventlog 2016-04-18 10:59:15 INFO nxlog-ce-2.9.1504 started
2016-04-18T10:58:42.649+03:00 172.22.1.136 eventlog 2016-04-18 10:59:15 INFO connecting to 172.22.1.40:3515
2016-04-18T10:58:42.649+03:00 172.22.1.136 eventlog 2016-04-18 10:59:15 ERROR failed to subscribe to msvistalog events,the channel was not found [15007]; The specified channel could not be found. Check channel configuration.
2016-04-18T10:58:41.645+03:00 172.22.1.136 eventlog failed to subscribe to msvistalog events,the channel was not found [15007]
The specified channel could not be found. Check channel configuration.
2016-04-18T10:58:41.643+03:00 172.22.1.136 eventlog connecting to 172.22.1.40:3515

Please advise !

[hsmith]

What version of Windows are you running?

[idas]

Hello,

I have tried on windows 10 Pro and on Windows 8.1

[hsmith]

Can you take a look at this post and see if the bottom of it helps you out: https://nxlog.org/question/656/windows- ... -event-log