{"type":"doc","content":[{"type":"paragraph","content":[{"text":"NXLog is a tool for collecting, processing, and forwarding log events. ","type":"text"}]},{"type":"paragraph","content":[{"text":"This article is meant to provide guidance and examples for how to configure NXLog to forward events to Devo and it assumes a general understanding of how NXLog configuration files are structured. That said, there are often several ways of accomplishing the same thing so these instructions should be considered as guidance and not as law. We refer you to the ","type":"text"},{"text":"NXLog reference manual","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.nxlog.co/userguide/index.html"}}]},{"text":" for further information about any of the NXLog modules, directives, or procedures mentioned in the article.","type":"text"}]},{"type":"paragraph","content":[{"text":"This article describes how to set up parts of the configuration file to:","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"cff03f2a-97e7-4e2d-b84a-b90a2c3b1e31"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"db1df69b-0aa1-4e1f-bc13-0f228857b5ad"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Read events from a log file","type":"text"}]},{"type":"paragraph","content":[{"text":"To read events from a log file, you can use the ","type":"text"},{"text":"im_file","type":"text","marks":[{"type":"strong"}]},{"text":" input module. ","type":"text"},{"text":"Read more about im_file here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.nxlog.co/refman/current/im/file.html"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"This module requires at least one directive, ","type":"text"},{"text":"file","type":"text","marks":[{"type":"strong"}]},{"text":", to specify the location and name of the file to read. Without including any other directives, the default behavior of this module will:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Monitor up to 10 files that match the file specification","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Keep input files open even when the latest event has been sent","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check for modifications to files every 2 seconds","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check for new files every 1 second","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the position of the last sent event and start from there the next time it's run","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Here's an example of an input module that will read all *.txt files in a specified folder on Windows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n Module im_file\n File \"C:\\\\ProgramData\\\\product\\\\logs\\\\*.txt\"\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Here's an example of an input module that will read from a file on Linux:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n Module im_file\n File \"/var/log/messages/filename*.log\"\n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Apply a fixed tag to all events read from a syslog file","type":"text"}]},{"type":"paragraph","content":[{"text":"When a program outputs its logs to a file in the syslog protocol format, we can use an ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" directive in the input module calling the ","type":"text"},{"text":"parse_syslog()","type":"text","marks":[{"type":"strong"}]},{"text":" procedure. This allows us to assign the Devo tag by setting the ","type":"text"},{"text":"$SourceName","type":"text","marks":[{"type":"strong"}]},{"text":" field; the field that corresponds to the tag part of the syslog message. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Because we are calling syslog procedures and fields, we need to include the ","type":"text"},{"text":"xm_syslog","type":"text","marks":[{"type":"strong"}]},{"text":" extension module. ","type":"text"},{"text":"Read more about xm_syslog here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.nxlog.co/refman/current/xm/syslog.html"}}]},{"text":".","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n\tModule\txm_syslog\n\n\n...\n\n\n Module im_file\n File \"/var/log/messages/filename*.log\"\n\tExec parse_syslog(); $SourceName = \"vpn.cisco.asa.anyconnect\";\n","type":"text"}]},{"type":"paragraph","content":[{"text":"We can also assign the tag in the output module. In that case, we include one ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" directive calling the ","type":"text"},{"text":"to_syslog_bsd()","type":"text","marks":[{"type":"strong"}]},{"text":" procedure and another ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" to assign the ","type":"text"},{"text":"$SourceName","type":"text","marks":[{"type":"strong"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Apply a dynamic tag to events read from a file","type":"text"}]},{"type":"paragraph","content":[{"text":"Sometimes, the correct Devo tag to apply to a single event will depend upon content found within the raw event. This is the case with Meraki Network Security logs so we'll use them as an example.","type":"text"}]},{"type":"paragraph","content":[{"text":"Meraki logging uses syslog protocol format so we will call the extension module ","type":"text"},{"text":"xm_syslog","type":"text","marks":[{"type":"strong"}]},{"text":". We'll use the ","type":"text"},{"text":"im_file","type":"text","marks":[{"type":"strong"}]},{"text":" module and set the ","type":"text"},{"text":"File","type":"text","marks":[{"type":"strong"}]},{"text":" directive to read all files in the specified directory that match the meraki*.log name pattern. Then we include one ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" directive calling the ","type":"text"},{"text":"parse_syslog()","type":"text","marks":[{"type":"strong"}]},{"text":" procedure. The second ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" directive uses a regular expression to reflect the pattern of the event headers and identify the defining value as a capturing group. Now when we assign the ","type":"text"},{"text":"$SourceName","type":"text","marks":[{"type":"strong"}]},{"text":" field, we specify the concatenation of \"network.meraki.\" and the value inside the capturing group.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n\tModule\txm_syslog\n\n\n...\n\n\n Module im_file\n File \"/var/log/meraki*.log\"\n\tExec\tparse_syslog(); \n\tExec\tif $raw_event =~ /^[^ ]+ [^ ]+ ([^ ]+) .*/; $SourceName= \"network.meraki.\" + $1;\n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Send events securely and directly to Devo","type":"text"}]},{"type":"paragraph","content":[{"text":"To forward events directly and securely using SSL to Devo, use the ","type":"text"},{"text":"om_ssl","type":"text","marks":[{"type":"strong"}]},{"text":" output module and we define a Route module that sends an input to an output. The minimum required directives for ","type":"text"},{"text":"om_ssl","type":"text","marks":[{"type":"strong"}]},{"text":" are ","type":"text"},{"text":"Host","type":"text","marks":[{"type":"strong"}]},{"text":" , ","type":"text"},{"text":"Port","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"CAFile","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"CertFile","type":"text","marks":[{"type":"strong"}]},{"text":", and ","type":"text"},{"text":"CertKeyFile","type":"text","marks":[{"type":"strong"}]},{"text":". These provide the destination and secure accesss to your Devo domain. ","type":"text"},{"text":"Read more about om_ssl here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.nxlog.co/refman/current/om/ssl.html"}}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"To download the certificate files, log into your Devo domain and go to ","type":"text"},{"text":"Administration → Credentials","type":"text","marks":[{"type":"strong"}]},{"text":", then open the ","type":"text"},{"text":"X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":" tab.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"We also need to include an ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" directive calling the ","type":"text"},{"text":"to_syslog_bsd()","type":"text","marks":[{"type":"strong"}]},{"text":" procedure - it uses the event's fields to build a BSD syslog formatted log message. Finally, we also include an ","type":"text"},{"text":"OutputType ","type":"text","marks":[{"type":"strong"}]},{"text":"directive calling the ","type":"text"},{"text":"Syslog_TLS","type":"text","marks":[{"type":"strong"}]},{"text":" procedure that prepends the payload size to the message.","type":"text"}]},{"type":"paragraph","content":[{"text":"Here's a simple example that includes the input we described earlier, output to a Devo cloud, and a Route module that sends the input to the output.","type":"text"}]},{"type":"codeBlock","content":[{"text":"define ROOT C:\\Program Files (x86)\\NXLog\ndefine CERTDIR %ROOT%\\cert\n\n\n\tModule\t\txm_syslog\n\n\n\n Module im_file\n File \"/var/log/messages/filename*.log\"\n\tExec\tparse_syslog()\n\tExec\t$SourceName = \"vpn.cisco.asa.anyconnect\";\n\n\n\n\tModule\t\tom_ssl\n\tHost XX.elb.relay.logtrust.net\n\tPort 443\n\tCAFile %CERTDIR%\\chain.crt\n\tCertFile %CERTDIR%\\domain.crt\n\tCertKeyFile %CERTDIR%\\domain.key\n\tExec\t\tto_syslog_bsd();\n\tOutputType Syslog_TLS\n\n\n\n\t\n\tPath cisco_anyconn => devo_cloud\n\t","type":"text"}]},{"type":"paragraph","content":[{"text":"In the example above, the Devo tag is applied in the input module. It is also possible to do so in an output module. Whether you do it one way or the other depends on your overall strategy for managing the NXLog activity. For example, you may choose to keep your outputs as \"generic\" as possible so that they can be used for several different inputs. Alternatively, you can create a single output to Devo containing multiple rules using ","type":"text"},{"text":"Exec","type":"text","marks":[{"type":"strong"}]},{"text":" directives that apply tags to events coming from multiple inputs.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Send events to a Devo Relay","type":"text"}]},{"type":"paragraph","content":[{"text":"To forward events to a Devo relay that sits within your network, use the ","type":"text"},{"text":"om_tcp","type":"text","marks":[{"type":"strong"}]},{"text":" output module. If the output module is only meant to forward events already tagged in their input module, then it's only necessary to indicate the Host as the IP address of the Devo Relay and the Port as 13000. Port 13000 is one of ","type":"text"},{"text":"the 4 predefined relay rules","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/96469422"}}]},{"text":" and simply forwards them to Devo.","type":"text"}]},{"type":"paragraph","content":[{"text":"However, if you will use the relay to apply the Devo tag(s), you will need to indicate the port on which you have set up the ","type":"text"},{"text":"relay rule","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/96469377"}}]},{"text":" for processing the events.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n Module om_tcp\n Host 192.168.1.1\n Port 13000\n","type":"text"}]},{"type":"paragraph","content":[{"text":"This configuration can also be used as a guide for routing events to a central log server that resides in the same network.","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Related articles","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"NXLog documentation home page","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.nxlog.co/userguide/index.html"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"NXLog for Windows event collection","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/latest/pages/94658530"}}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}

Browser not supported