How to Collect Windows Event Logs to Graylog2 using NXLog

Sending Event logs to Graylog2 from Windows is easy, thanks to a lot of log tools like syslog-ng, rsyslog, … and NXlog. In this tutorial, we will show you how to install and configure NXlog to send Windows Event logs to Graylog 2 Server.

If you don’t installed yet Graylog2 , you can check the following topics:

• How To Install and Configure Graylog Server on Ubuntu 16.04 LTS
• How To Install and Configure Graylog Server on CentOS 7/ RHEL7
• How to Configure Nginx As Reverse Proxy for Graylog2

1./ Install and Configure NXLog

– On your Windows machine, install the NXLog package from the official download page.

– Once you are done with the installation, open the nxlog.conf located in

C:\Program Files (x86)\nxlog\conf\nxlog.conf

######################################################
############## Extensions ############################

<Extension _gelf>
    Module      xm_gelf
</Extension>
########## INPUTS ###########
<Input in>
    Module      im_msvistalog
# For windows 2003 and earlier use the following:
#   Module      im_mseventlog

</Input>
########################################
################# OUTPUTS ##############
<Output out>

    Module      om_udp    
    Host        YOUR_GRAYLOG_IP
    Port        12201
    #Exec       to_syslog_snare();
    OutputType  GELF 

</Output>
#######################################
#################### ROUTE  ###########
<Route 1>
    Path in => out
</Route>

The above configuration will collect all Application and System logs. If you want something more complicated, refer to the NXLog documentation at https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html

– Go to the service administration Tool and start the NXLog Service

Create a new Graylog Input

– In order for Graylog to receive the messages and logs from the device, a new source should be added to the Graylog server using the web interface.

-1/ Login to Graylog Web Interface using the below link (change according to the IP of the server you are using):

http://your_graylog_ip:9000

-2/ Click on System/Inputs , and choose Inputs

-3/ Choose GELF UDP and click on Launch new input

– A new popup will show. Choose a relevant Title for your input, choose the Bind address to be the IP of the Graylog server and finaly save.

We hope this tutorial was enough Helpful. If you need more information, or have any questions, just comment below and we will be glad to assist you!

If you like our content, please consider buying us a coffee. Thank you for your support!