Use https://seceonhelp.freshdesk.com/support/login to access updated Knowledge Base Articles, Submit Technical Support Tickets and Review Status of submitted support tickets.
Windows IIS Nxlog configuration
- Customer Success & Engineering (Unlicensed)
Overview
Microsoft Internet Information Server supports several logging formats. This chapter provides information about configuring IIS logging and NXLog collection. The recommended W3C format is documented below as other supported IIS formats.
Configure Nxlog on the IIS server
Download the latest version of nxlog. It is easiest to choose the Windows MSI file which includes an installer.
3. Open the Nxlog configuration file at:
C:\Program Files (x86)\nxlog\conf\nxlog.conf
4. Replace the entire configuration file by pasting the following Below – Note to replace the variable ({IP address of Seceon Server}) with the actual Seceon Server IP address:
## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
define ROOT C:\Program Files\nxlog
#define ROOT C:\Program Files (x86)\nxlog
#define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension _json>
Module xm_json
</Extension>
<Extension syslog>
Module xm_syslog
</Extension>
define aisiem \
1, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 14, 15, 17, 18,19, 20, 21, 104, 258, 259, 260, \
261, 262, 500, 517, 520, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539,\
540, 551, 552, 565, 600, 608, 609, 621, 622, 626, 627, 628, 629, 630, 636, 642, 644,\
645, 647, 632, 663, 664, 671, 673, 675, 676, 677, 679, 680, 681, 682, 683, 684, 689,\
690, 692, 1001, 1006, 1007, 1008, 1015, 1102, 1116, 1117, 1118, 1119, 2003, 2100, \
7034, 4624, 4625, 4634, 4647, 4649, 4656, 4657, 4659, 4661, 4663, 4670, 4688, 4697, \
4704, 4705, 4717, 4718, 4720, 4722, 4723, 4724, 4725, 4726, 4727, 4728, 4729, 4730, \
4731, 4732, 4733, 4734, 4735, 4737, 4738, 4739, 4740, 4741, 4742, 4743, 4744, 4745, \
4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4754, 4755, 4756, 4757, 4758, 4759, \
4760, 4761, 4762, 4763, 4764, 4767, 4769, 4771, 4772, 4773, 4775, 4776, 4777, 4778, \
4779, 4780, 4782, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4793, 4794, \
4797, 4798, 4800, 4801, 4802, 4803, 5001, 5004, 5007, 5010, 5012, 5136, 5137, 5140, \
5141, 5142, 5143, 5144, 5145, 5376, 5377, 7045, 8003, 8004, 8007, 64004
<Input in>
Module im_msvistalog
Query <QueryList>\
<Query Id="0">\
<Select Path="Security">* </Select>\
<Select Path="Application">* </Select>\
<Select Path="Setup">* </Select>\
<Select Path="System">* </Select>\
</Query>\
</QueryList>
<Exec>
if ($EventID NOT IN (%aisiem%)) drop();
</Exec>
</Input>
<Output out>
Module om_udp
Host 10.0.0.1
Port 5154
Exec to_json();
</Output>
<Input in_iis>
Module im_file
File "C:\\inetpub\\logs\\LogFiles\\W3SVC*\u_ex*"
SavePos TRUE
ReadFromLast TRUE
Exec if $raw_event =~ /^#/ drop();
Exec $Message = $raw_event;
</Input>
<Output out_iis>
Module om_udp
Host 10.0.0.1
Port 514
Exec $SyslogFacilityValue = 2;
Exec $SourceName = 'windows_iis_logs';
Exec to_syslog_bsd();
</Output>
<Route in-to-out>
Path in_iis => out_iis
</Route>
<Route 1>
Path in => out
</Route>5. Restart nxlog services.
Enable Logging on the IIS server
IIS logging can be configured at the site or service levels. For more detailed information, see Configure Logging in IIS on Microsoft Docs.
Open IIS Manager, which can be accessed from the Tools menu in the Server Manager or from Administrative Tools.
In the Connections, the pane on the left, select the server or site for which to configure logging. Select a server to configure logging server-wide, or a site to configure logging for that specific site.
Double-click the Logging icon in the centre pane.
4. Modify the logging configuration as required. The W3C format is recommended.
The resulting logs can be collected by NXLog as shown in the following sections.
Verification
On Windows server using NXLOG Utility
When issues arise while configuring or maintaining an NXLog instance, a stepwise troubleshooting approach (moving from the most likely and simple cases to the more complex and rare ones) generally yields favourable results. The first step is always to inspect the internal log which NXLog generates.
By default, NXLog generates log messages about its own operations. These messages are essential for troubleshooting problems and should be checked first if NXLog is not functioning as expected.
These internal messages are written to the file defined in the LogFile directive in nxlog.conf. On Windows that file is C:\Program Files\nxlog\data\nxlog.log; on Linux, /opt/nxlog/var/log/nxlog/nxlog.log.
If this directive is not specified, internal logging is disabled.
On Seceon devices end
This Can validate the success of configuration either on Seceon UI or on the CCE server.
Verification through the Seceon UI
Open Seceon UI >>Systems >> Dropdown systems and go inside logs and flows collection status.
Under the Source device IP address section the device configured will reflect.
Verification Through CCE server using the following command
“sudo tcpdump -i any host 514 and host <IP address> -AAA” command should be run on the CCE server to check whether or not we are getting logs.
Disclaimer
While we endeavour to keep the information on this topic up to date and correct, Seceon makes no representations or warranties of any kind, express or implied about the completeness, accuracy, reliability, suitability, or availability of the content represented here.
Last revision: 12 July 2022
Seceon Inc. All rights reserved. https://www.seceon.com