1.IMPORTANCE
2.STEPS OF CONFIGURATION
3.VERIFICATION
IMPORTANCE
NXLOG is used to process the collected information and send it from Windows event logs and forward these logs on to the OTM CCE.
STEPS OF CONFIGURATION:-
Login on collector/AD computer.
Download the latest version of nxlog. It is easiest to choose the Windows msi file which includes an installer. Use the link below for the community edition:
http://nxlog.org/products/nxlog-community-edition/download
...
Open the nxlog.conf file in notepad .
Replace the configuration file by pasting the following - Note to replace the variable (
IP Address of Seceon Collector) mentioned in point 52 below with the actual Seceon Server IP address:
...
Open Services (from search box on your windows) and restart nxlog from services or list of services. If you do not find this service, type the following commands at an elevated command prompt:
...
Enable audit logs: Windows- Enable Audit Logs/Policies
Open Command Prompt , once policies are enabled , and run the command gpupdate /force , to validate that the policies are enabled .
VERIFICATION:-
Can validate the success of configuration either on UI or on CCE server.
...
“sudo tcpdump -i any host 514 5154 and host <IP address> -AAA” command should be ran on CCE server to check wheather or not we are getting logs .