Using NXLog to Collect Windows Event Logs

There are a lot of syslog collectors for Windows, but when it comes to stability and features, NXlog has the best chances to fulfill all the requirements.

Windows EventLog allows multi-line messages, so this text is a lot more readable and nicely formatted by spaces, tabs and line-breaks as can be seen in Event Viewer. Because syslog only reads/writes single-line messages, this formatting must be stripped of the EventLog message. In doing so, we lose the meta-data. NXlog is capable of reading these fields, recognize the structure and forward these remotely (or act on them for alerting purposes), thus sparing you time and resources. So, if you use the NXlog framework (client/server) there will be no need to spend time writing patterns to extract usernames, IP addresses and similar meta-data.

Feature	Note
NXlog is a complete framework	It can act as client and/or as server for almost all systems: RedHat/CentOS-, Debian-, Ubuntu-Linux; Windows and Android
Supports TCP and UDP Transport Protocol	Default Syslog uses UDP/514 but the fire and forget principle of UDP may not satisfy reliability requirements
Transport Encryption trough SSL	Confidentiality requirements may imply an encryption over the line
Easy Deployment	low footprint installation, runs as service/daemon
Well documented	The manual is very well made and plenty of additional information is available online
Open Source	Honestly, do you miss this feature somewhere? ;)
Supports syslog format (RFC3164 and RFC5424)	Although still not the best event format out there, syslog always offers compatibility for further processing
Supports structured events format (meta-data structure awareness)	NXlog is capable of processing the Windows event log format natively. It reads CSV, JSON, XML, GELF as well as Windows EventLog
Clean and easy configuration	You can create a very complex and feature rich configuration. But the basic forwarding configuration is done a few minutes after the installation
Built-in scheduling and log rotation	NXlog has a built-in scheduler similar to cron, but with more advanced capabilities to specify timing
No Message Loss	NXlog will not drop log messages; it will throttle the input side wherever possible. However, it can be explicitly instructed to drop log messages to avoid possible resource exhaustion
Modular Architecture	Dynamically loadable modules (plugins) are available to provide different features and add functionality

Topology:

1. Download NXLog Community Edition
On Windows 7 VM, download the NXLog package from the official download : https://nxlog.co/products/nxlog-community-edition/download


2. Install NXLog

Install NXLog in the regular “next -> next -> finish” fashion. In this lab, I installed on machine 10.94.200.137, a Windows 7 64b VM workstation.


3. Configure NXLog conf file.
Most configuration is default settings. You will need to add three sections in: input, output, and route.

Panic Soft
#NoFreeOnExit TRUE
define ROOT     C:\Program Files (x86)\nxlog
define CERTDIR  %ROOT%\cert
define CONFDIR  %ROOT%\conf
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir  %ROOT%\data
Pidfile   %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data
<Extension _syslog>
    Module      xm_syslog
</Extension>
<Extension _charconv>
    Module      xm_charconv
    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
</Extension>

<Extension _exec>
    Module      xm_exec
</Extension>

<Extension _fileop>
    Module      xm_fileop
    # Check the size of our log file hourly, rotate if larger than 5MB
    <Schedule>
        Every   1 hour
        Exec    if (file_exists('%LOGFILE%') and \
                   (file_size('%LOGFILE%') >= 5M)) \
                    file_cycle('%LOGFILE%', 8);
    </Schedule>
    # Rotate our log file every week on Sunday at midnight
    <Schedule>
        When    @weekly
        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>
</Extension>



<Input in>
    Module      im_msvistalog
# For windows 2003 and earlier use the following:
#   Module      im_mseventlog
</Input>

<Output out>
Module om_udp
Host 10.94.200.233
Port 514
</Output>

#################### ROUTE  ###########
<Router r2>
    Path in => out
</Route>

Note: Each time, when you changed the conf file, the NXLog service has to be restarted.

4. Install SyslogWatcher
In this lab, Syslog Watcher installed on a Windows 2008 server as log server.

• Download the latest Syslog Watcher.
• Install in the regular “next -> next -> finish” fashion.
• Open the program from the “start menu”.
• When prompted to select the mode of operation, select: “Manage local Syslog server”.
• If prompted by Windows UAC, approve the administrative rights request.
• Start the service by clicking the huge “Play” button on the top left.

5. Test
Open Command Prompt as Administrator and enter the following command:
EVENTCREATE /ID 1 /L APPLICATION /T INFORMATION /SO TestLOGSOURCE /D "EventTesting"

Microsoft Windows [Version 10.0.17134.706]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>EVENTCREATE /ID 1 /L APPLICATION /T INFORMATION /SO TestLOGSOURCE /D "EventTesting"

SUCCESS: An event of type 'INFORMATION' was created in the 'APPLICATION' log with 'TestLOGSOURCE' as the source.

C:\WINDOWS\system32>