Let's say, our application which is running on a Windows 2016 server which is generating customs logs and we want to send those logs to our central syslog or SIEM server. For log collection and forwarding we will use NXLog Community Edition. NXLog Community Edition is an open source log collection tool available at no cost.
Let's assume our syslog server (e.g. graylog or Qradar) is installed and configured. We will just collect and forward logs from a Windows Server to destination server. To achieve that, let's follow below steps:
1) Install NXLog Community Edition.
2) Depending on this installation location, update the configuration file nxlog.conf. In my case, the file location is C:\Program Files (x86)\nxlog\conf
3) Let's say we wanna forward access and error logs. Add below configuration in the above mentioned configuration file. Beforehand, make sure the input methods are properly configured and service is running on respective server. In case of graylog, GELF input method is configured and running (Picture-1)
# For sending logs to graylog, we'll use xm_gelf module. Add below in configuration file.
# Assume graylog server IP is 10.10.100.100 and QRadar server IP is 10.10.100.200.
# Application is generating custom logs at a shared folder under directory \\10.20.30.40\LOG\WebApp\
<Extension _gelf>
Module xm_gelf
</Extension>
# send logs to graylog
<Input application_accesslog_graylog>
Module im_file
File '\\10.20.30.40\LOG\WebApp\Information\\accesslog_*'
#File 'C:\Program Files (x86)\nxlog\data\\*.log'
PollInterval 1
SavePos True
ReadFromLast True
Recursive False
RenameCheck False
Exec $FileName = file_name();
</Input>
<Input application_errorlog_graylog>
Module im_file
File '\\10.20.30.40\LOG\WebApp\Error\\errorlog_*'
#File 'C:\Program Files (x86)\nxlog\data\\*.log'
PollInterval 1
SavePos True
ReadFromLast True
Recursive False
RenameCheck False
Exec $FileName = file_name();
</Input>
<Output gelf>
Module om_tcp
Host 10.10.100.100
Port 12201
OutputType GELF_TCP
</Output>
<Route graylog>
Path application_accesslog_graylog , application_errorlog_graylog => gelf
</Route>
# send logs to QRadar
<Input application_accesslog_qradar>
Module im_file
File '\\10.20.30.40\LOG\WebApp\Information\\accesslog_*'
#File 'C:\Program Files (x86)\nxlog\data\\*.log'
ReadFromLast False
Exec parse_syslog();
Exec log_info("Input Event: " + $raw_event);
</Input>
<Input application_errorlog_qradar>
Module im_file
File '\\10.20.30.40\LOG\WebApp\Error\\errorlog_*'
#File 'C:\Program Files (x86)\nxlog\data\\*.log'
ReadFromLast False
Exec parse_syslog();
Exec log_info("Input Event: " + $raw_event);
</Input>
<Output event-out-qradar>
Module om_tcp
Host 10.10.100.200
Port 514
</Output>
<Route qradar>
Path application_accesslog_qradar, application_errorlog_qradar => event-out-qradar
</Route>
############################
#End of configuration file
############################
4) Save the configuration file and restart nxlog service from services.msc
After login to respective portal, verify the results.
Picture-2: graplog
Picture-3: QRadar
Cheers :-)
