| Table of Contents |
|---|
Overview
...
C:\Program Files (x86)\nxlog\conf\nxlog.conf
4. Replace the entire configuration file by pasting the following Below – Note to replace the variable ({IP address of Seceon Server}) with the actual Seceon Server IP address:
| Code Block |
|---|
## This is a sample configuration file. See the nxlog reference manual about the ## configuration options. It should be installed locally and is also available ## online at http://nxlog.org/docs/ ## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. define ROOT C:\Program Files\nxlog #define ROOT C:\Program Files (x86)\nxlog |
...
#define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules |
...
CacheDir %ROOT%\data |
...
Pidfile %ROOT%\data\nxlog.pid |
...
SpoolDir %ROOT%\data |
...
LogFile %ROOT%\data\nxlog.log |
...
<Extension _json> Module xm_json </Extension> <Extension syslog> Module xm_syslog |
...
</Extension> define aisiem \ 1, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 14, 15, 17, 18,19, 20, 21, 104, 258, 259, 260, \ 261, 262, 500, 517, 520, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539,\ 540, 551, 552, 565, 600, 608, 609, 621, 622, 626, 627, 628, 629, 630, 636, 642, 644,\ 645, 647, 632, 663, 664, 671, 673, 675, 676, 677, 679, 680, 681, 682, 683, 684, 689,\ 690, 692, 1001, 1006, 1007, 1008, 1015, 1102, 1116, 1117, 1118, 1119, 2003, 2100, \ 7034, 4624, 4625, 4634, 4647, 4649, 4656, 4657, 4659, 4661, 4663, 4670, 4688, 4697, \ 4704, 4705, 4717, 4718, 4720, 4722, 4723, 4724, 4725, 4726, 4727, 4728, 4729, 4730, \ 4731, 4732, 4733, 4734, 4735, 4737, 4738, 4739, 4740, 4741, 4742, 4743, 4744, 4745, \ 4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4754, 4755, 4756, 4757, 4758, 4759, \ 4760, 4761, 4762, 4763, 4764, 4767, 4769, 4771, 4772, 4773, 4775, 4776, 4777, 4778, \ 4779, 4780, 4782, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4793, 4794, \ 4797, 4798, 4800, 4801, 4802, 4803, 5001, 5004, 5007, 5010, 5012, 5136, 5137, 5140, \ 5141, 5142, 5143, 5144, 5145, 5376, 5377, 7045, 8003, 8004, 8007, 64004 <Input in> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Security">* </Select>\ <Select Path="Application">* </Select>\ <Select Path="Setup">* </Select>\ <Select Path="System">* </Select>\ </Query>\ </QueryList> <Exec> if ($EventID NOT IN (%aisiem%)) drop(); </Exec> </Input> <Output out> Module om_udp Host 10.0.0.1 Port 5154 Exec to_json(); </Output> <Input in_iis> Module im_file File "C:\\inetpub\\logs\\LogFiles\\W3SVC*\u_ex*" |
...
SavePos TRUE |
...
ReadFromLast TRUE |
...
Exec if $raw_event =~ /^#/ drop(); |
...
Exec $Message = $raw_event; |
...
</Input> |
...
<Output out_iis> |
...
Module om_udp |
...
Host 10.0.0.1 Port 514 Exec $SyslogFacilityValue = 2; Exec $SourceName = 'windows_iis_logs'; |
...
Exec to_syslog_bsd(); |
...
</Output> |
...
<Route in-to-out> |
...
Path in_iis => out_iis |
...
</Route> <Route 1> Path in => out </Route> |
5. Restart nxlog services.
...
Open IIS Manager, which can be accessed from the Tools menu in the Server Manager or from Administrative Tools.
In the Connections, the pane on the left, select the server or site for which to configure logging. Select a server to configure logging server-wide, or a site to configure logging for that specific site.
Double-click the Logging icon in the centre pane.
...
4. Modify the logging configuration as required. The W3C format is recommended.
...
The resulting logs can be collected by NXLog as shown in the following sections.
Verification
On Windows server using NXLOG Utility
...