Windows Apache/Tomcat Nxlog Configuration

1 Overview
2 Steps Of Configuration
3 VERIFICATION OF CONFIGURATION
- 3.1 Using UI
- 3.2 Using CCE SERVER:

Overview

Apache Tomcat is open source web server software for Java programming developed and maintained by the Apache software foundation. The initial idea of Apache tomcat software was to host and deploy the Java servlet that is the server-side Java code that manages HTTP results from client applications build using Java. It acts as a web server rather than a full-fledged application server that includes data persistence and load balancing capabilities. Apache Tomcat provides the basic feature of web server processing for the relevant servlets. It supports the java servlet lifecycle that are init(),service() and destroy() phases. It is the preferred web server software for Java implementations.

Before configuration the port 514 and 5154 need to be allowed from the firewall.

During the following process of configuration device will be integrated to our CCE and logs will be collected from the device.

Steps Of Configuration

NXLOG is used to process the collected information and send it on to the OTM CCE.

Login on collector/AD computer.
Download the latest version of nxlog. It is easiest to choose the Windows msi file which includes an installer. Use the link below:

http://nxlog.org/products/nxlog-community-edition/download

Open the Nxlog configuration file at:

C:\Program Files (x86)\nxlog\conf\nxlog.conf

Replace the entire configuration file by pasting the following Below – Note to replace the variable (IP Address of Seceon Collector) with the actual Seceon Server IP address:

##################################################

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _json>    
  	Module xm_json
</Extension>

define aisiem                                                                       \
1, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 14, 15, 17, 18,19, 20, 21, 104, 258, 259, 260,  \
261, 262, 500, 517, 520, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539,\
540, 551, 552, 565, 600, 608, 609, 621, 622, 626, 627, 628, 629, 630, 636, 642, 644,\
645, 647, 632, 663, 664, 671, 673, 675, 676, 677, 679, 680, 681, 682, 683, 684, 689,\
690, 692, 1001, 1006, 1007, 1008, 1015, 1102, 1116, 1117, 1118, 1119, 2003, 2100,   \
7034, 4624, 4625, 4634, 4647, 4649, 4656, 4657, 4659, 4661, 4663, 4670, 4688, 4697, \
4704, 4705, 4717, 4718, 4720, 4722, 4723, 4724, 4725, 4726, 4727, 4728, 4729, 4730, \
4731, 4732, 4733, 4734, 4735, 4737, 4738, 4739, 4740, 4741, 4742, 4743, 4744, 4745, \
4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4754, 4755, 4756, 4757, 4758, 4759, \
4760, 4761, 4762, 4763, 4764, 4767, 4769, 4771, 4772, 4773, 4775, 4776, 4777, 4778, \
4779, 4780, 4782, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4793, 4794, \
4797, 4798, 4800, 4801, 4802, 4803, 5001, 5004, 5007, 5010, 5012, 5136, 5137, 5140, \
5141, 5142, 5143, 5144, 5145, 5376, 5377, 7045, 8003, 8004, 8007, 64004

<Extension syslog>
	Module xm_syslog
</Extension>

<Input Apache_In>
	Module im_file
	File "C:\Program Files\Apache Software Foundation\Tomcat 9.0_Tomcat9.0\localhost_access_log.*"
	SavePos TRUE
	InputType LineBased
	Exec if $raw_event =~ /^#/ drop();
	Exec $Message = $raw_event;
</Input>

<Input in>
      Module im_msvistalog
      Query <QueryList>\
                  <Query Id="0">\
                        <Select Path="Security">* </Select>\
                        <Select Path="Application">* </Select>\
                        <Select Path="Setup">* </Select>\
                        <Select Path="System">* </Select>\
                  </Query>\
            </QueryList>
            <Exec>
                  if ($EventID NOT IN (%aisiem%)) drop();
            </Exec>
</Input>

<Output Apache_Out>
	Module om_udp
	Host CCE_IP
	Port 514
	Exec $SyslogFacilityValue = 2;
	Exec $SourceName = 'apache';
	Exec to_syslog_bsd();
</Output>

<Output out>    
  	Module om_udp    
  	Host CCE_IP
  	Port 5154    
  	Exec to_json();
</Output>

<Route Apache_Out>
	Path Apache_In => Apache_Out
</Route>

<Route 1>    
  	Path in => out
</Route>

Restart nxlog from services or type the following at an elevated command prompt:

net stop nxlog

net start nxlog

VERIFICATION OF CONFIGURATION

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Login to Seceon UI >> SYSTEM

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS .

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

Using CCE SERVER:

“sudo tcpdump -i any host 5154 and host <IP address> -AAA” command should be ran on CCE server to check whether or not we are getting logs .