To export logs from Windows machines/servers, we use a third party software called "Nxlog".
A. Types of Windows logs
Windows servers have two type of logs:
- Windows Native Logs
- Windows based Application logs
A.1 Windows Native Logs -
For these, we can use both the Event collection options - B.1 or B.2 below, to collect the events. Example - OS Logs, Audit Logs and USB Logs.
A.2 Windows based Application Logs -
For Application logs we have to use Event collection option- B.1, which is to run nxlog agent on the server to read the logs from specific location and export to CCEs. Example: MSSQL, DNS , DHCP, IIS, MsExchange and SMTP.
B.Methods of Event Collection from Windows -
There are two methods of event collection from Windows servers, depending on the type of logs the server generates:
- Nxlog Agent configured on the same server
- Nxlog Agent configured on a collector setup
Both the methods are described as below:
B.1 Nxlog Agent configured on the same server:
In this case, the Nxlog configuration is done on the same server from which the logs are forwarded. In case of nxlog configuration from:
- Base OS: Please use the instructions as in the link below to configure nxlog:
- Application logs from MSSQL: Please use the instructions as in the link below:
Configuring logs from Windows MSSQL server
- Application logs from DNS: Please use the instructions as in the link below:
Configuring DHCP logs from DHCP server using Nxlogs
- Application logs from DHCP: Please use the instructions as in the link below:
Configure Logs from Windows DNS server
- Application logs from IIS: Please use the instructions as in the link below:
Configuring logs from Windows IIS server
- Application logs from MS Exchange - Please use the instructions as in the link below:
Nxlog configuration for MS Exchange server
- Application logs from SMTP- Please use the instructions as in the link below:
Configuring SMTP server using Nxlog
Note: In certain scenario if Partner/customer can mount application logs location to collector or any other centralized location then we can use both Event collection option.
B.2 Windows Collector (Windows Event Subscriptions with Nxlog configured on Collector setup)
This method requires three steps as below:
1.Collector Machine Setup:
Collector machine will be one small VM, with configurations as below:
- Compute Power: Windows 2012 Server- 2 Ghz or faster.
- Minimum Memory DRAM: 2 GB
- Minimum Disk: 40 GB
- Network Interface: 1 GigE
2.Subscription:
Once the collector VM is up and running, subscriptions can be added to it for all the windows machines in the same domain we have to get the logs forwarded from. For subscriptions, please refer to the instructions as in the link:
Event collection at windows collector computer
3. Event forwarding from source computers to the Collector
To enable the events to be forwarded from the remote computers to the collector computers, the steps that needs to be performed are as in the link:
Event forwarding from Source Windows Computers
4.Nxlog Configuration:
Once the events are forwarded from the remote computers to the collector computer. We need to configure Nxlog on the collector computer to in turn forward the collected events to our CCE. To configure the same, please refer to: