I’m trying to further filter Windows 2012 events in nxlog-ce-2.9.1716 on the server, before they reach our GrayLog 2.4.6 server. Other examples I’ve found online or in the nxlog manuals don’t seem to go into as much detail - or if they do I can’t wrap my head around it. Would love any help to resolve this and hopefully set a detailed example others can reference in the future
- I already have specific Windows events coming into Graylog just fine
- I’m avoiding filtering on the GrayLog stream, want to filter before it leaves the server - as some events are really noisy
- While below is an example of a specific event, I’m essentially after the right syntax so I can apply to multiple events
- Open to any suggestions, if there is a better way of achieving this
So as an example, MS EventID 4776 captures domain controller logins (both successful and failed). According to MS docs, this is defined under a “Status” code. 0x0 means successful and anything else like 0xc0000064 means failed. The image below shows a failed attempt and the XML structure i’m working with.
In the nxlog.conf below. I’m attempting to filter EventID 4776. I want to only to send events that are not equal to 0x0, ie: only send failures. I’ve tried a few different ways, which prevent the nxlog windows service from starting - below will allow the service to successfully start, but no events for 4776 come through.
If anyone can please give a correct example or point me in the right direction, that would be amazing.
define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Extension _syslog> Module xm_gelf </Extension> <Input in> Module im_msvistalog Query <QueryList>\ <Query Id="0">\ <Select Path="Security">*[System[(EventID=4720)]]</Select>\ <Select Path="Security">*[System[(EventID=4701)]]</Select>\ <Select Path="Security">*[System[(EventID=4756)]]</Select>\ <Select Path="Security">*[System[(EventID=1102)]]</Select>\ <Select Path="Security">*[System[(EventID=4776)] and *[EventData[Data[@Name='Status'] and (Data !='0x0')]]]</Select>\ </Query>\ </QueryList> </Input> <Output out> Module om_udp Host <removed> Port <removed> OutputType GELF </Output> <Route 1> Path in => out </Route>