NetXMS Support Forum

Hi!

I've configured NetXMS to act as central syslog server. Remote ubuntu and centos machines are sending information and everything is displayed correctly.

Regarding windows - i use nxlog agent on windows server 2016 machine.

Key configuration:

<Input in>
    Module  im_msvistalog
    Query       <QueryList>\
                    <Query Id="0">\
                        <Select Path="Application">*</Select>\
                        <Select Path="System">*</Select>\
                        <Select Path="Security">*</Select>\
                    </Query>\
                </QueryList>
</Input>

<Processor proc>
   Module pm_transformer
   Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
   OutputFormat syslog_rfc5424
</Processor>

<Output udp>
   Module  om_udp
   Host    xx.xx.xx.xx
   Port    514
   Exec $raw_event = replace($raw_event,"\r\n"," ");
   Exec $raw_event = replace($raw_event,"\t"," ");
</Output>

<Route in_to_udp>
    Path    in => proc => udp
</Route>

Example of syslog text message received:

1 2018-09-09T05:56:00.660046+00:00 EC2AMAZ-O9GPR2C - 752 - [NXLOG@14506 Keywords=""-9214364837600034816"" EventType=""AUDIT_SUCCESS"" EventID=""4776"" ProviderGuid=""{54849625-5478-4994-A5BA-3E3B0328C30D}"" Version=""0"" Task=""14336"" OpcodeValue=""0"" RecordNumber=""565505"" ActivityID=""{6F6FC6C1-1842-0000-06B6-D6784218D401}"" ThreadID=""8936"" Channel=""Security"" Category=""Credential Validation"" Opcode=""Info"" PackageName=""MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"" TargetUserName=""Administrator"" Workstation=""EC2AMAZ-O9GPR2C"" Status=""0x0"" EventReceivedTime=""1536472562"" SourceModuleName=""in"" SourceModuleType=""im_msvistalog""] The computer attempted to validate the credentials for an account.    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Logon Account: Administrator  Source Workstation: EC2AMAZ-O9GPR2C  Error Code: 0x0"

Tag for such is marked as "1". Is there a way to configure that Tag will be some other received field ? 

Maybe there is some good template available how to configure better nxlog WEF to work with NetXMS ? Should i use other format as output there ?

Thank You in advance.