Domain name in source field

[praveen (Nethula Praveen)]

We have setup NX log in four IIS servers and 3 servers sending the correct logs to Graylog.One of the app server sending domain name instead of hostname where as rest all three servers sending hostname .Looking for a solution .

Appreciate your help on this.Thanks in advance

[gsmith]

Hello && Welcome
On your nxlog configuration file you may need to add this configuration.

    Exec $Hostname = hostname_fqdn();
    Exec $FullMessage = $raw_event;
    #Exec        to_syslog_snare();
</Output>

This may depend on what type of INPUT your using. If you have a DNS server double check your
pointer record (PTR for short) for the server in question.

[praveen (Nethula Praveen)]

Hello Smith,

Thank you for your reply,

I have updated the configuration as given still getting source as domain name.

Please find the attached screenshot of log and nxlog config for your reference.![graylogscreenshot|690x394]

[praveen (Nethula Praveen)]

Please find the graylog screesnhot as well

[gsmith]

Hello,

How about this ill show you what I have and you can make the correction. Because my glasses are not that strong and those screen shot’s is hard to see

Here is my NXLOG config

nxlog_config

## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/docs/

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define LOGFILE C:\Program Files (x86)\nxlog\data\nxlog.log


Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _fileop>
    Module xm_fileop
    # Check the log file size every hour and rotate if larger than 5 MB
    <Schedule>
        Every 1 hour
        <Exec>
            if (file_exists('%LOGFILE%') and file_size('%LOGFILE%') >= 5M)
                file_cycle('%LOGFILE%', 8);
        </Exec>
    </Schedule>
    # Rotate log file every week on Sunday at midnight
    <Schedule>
        When    @weekly
        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>
</Extension>

<Extension gelf>
    Module      xm_gelf
 </Extension>

<Input in>
    Module      im_msvistalog    
</Input>

<Output out>
    Module         	 om_udp 
    Host         	 graylog.doamin.com
    Port        	 51412
    OutputType  	 GELF_UDP     
    Exec $Hostname = hostname_fqdn();
    Exec $FullMessage = $raw_event;
    #Exec        to_syslog_snare();
</Output>

<Route >
    Path        in => out
</Route>

This is what I receive.

hope that helps

EDIT: Just a suggestion your nxlog file you should organize it a little better , for example Keep all your Extension/s together normally right below you log rotation, INPUTS next… Then your Output and last on the bottom of the file is your route. This will help you later and others looking at it

[praveen (Nethula Praveen)]

Here is nxlog config , we are expecting hostname.dominname but we are getting IIS site name in place of source field and trying to find out root cause

Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data

Module xm_syslog Module xm_charconv AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 Module xm_exec Module xm_fileop

# Check the size of our log file hourly, rotate if larger than 5MB
<Schedule>
    Every   1 hour
    Exec    if (file_exists('%LOGFILE%') and \
               (file_size('%LOGFILE%') >= 5M)) \
                file_cycle('%LOGFILE%', 8);
</Schedule>

# Rotate our log file every week on Sunday at midnight
<Schedule>
    When    @weekly
    Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
</Schedule>

#######################################################################

EXTENTIONS

#######################################################################

Module xm_gelf Module xm_json

#######################################################################

IIS NXLOG

#######################################################################

Module xm_csv Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, $c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $time_taken, $X-Forwarded-For FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string Delimiter ' ' QuoteChar '"' EscapeControl FALSE UndefValue - Module im_file File "C:\inetpub\logs\LogFiles\W3SVC1\u_ex*" SavePos TRUE

Exec if $raw_event =~/^#/ drop();\
   else\
   {\
    w3c->parse_csv();\
    $EventTime = parsedate($date + " " + $time);\
$EventTime = parsedate($date + " " + $time + "Z");\
    $SourceName = "PP-IIS";\
$raw_event = to_json();\
   }

Module im_file File "C:\inetpub\logs\LogFiles\W3SVC2\u_ex*" SavePos TRUE

Exec if $raw_event =~/^#/ drop();\
   else\
   {\
    w3c->parse_csv();\
    $EventTime = parsedate($date + " " + $time);\
$EventTime = parsedate($date + " " + $time + "Z");\
    $SourceName = "xxxx-PR-IIS";\
$raw_event = to_json();\
   }

Module om_udp Host xxxx.xxxx.xxxx.xxxx Port xxxx OutputType GELF

Exec        $Hostname = hostname_fqdn();
    Exec    $FullMessage = $raw_event;
    #Use the following line for debugging (uncomment the fileop extension above as well)
#Exec file_write("C:\\Program Files (x86)\\nxlog\\data\\nxlog_output.log", $raw_event);

Path pp-iis => graylog Path xxxx-pr-iis => graylog

#######################################################################

/IIS NXLOG

#######################################################################

[praveen (Nethula Praveen)]

Here is the remianing config

Module om_udp Host xxxx.xxxx.xxxx.xxxx Port xxxx OutputType GELF

Exec        $Hostname = hostname_fqdn();
    Exec    $FullMessage = $raw_event;
    #Use the following line for debugging (uncomment the fileop extension above as well)
#Exec file_write("C:\\Program Files (x86)\\nxlog\\data\\nxlog_output.log", $raw_event);

Path pp-iis => graylog Path xxxx-pr-iis => graylog

#######################################################################

/IIS NXLOG

#######################################################################

[gsmith]

When post Config files or commands please look here

How to Post a Question in the Community that Gets Responses

This platform is made with love for community discussions on the open source tool Graylog, it components and usage. Here’s a Graylog support-inspired template (thank you, @aaronsachs ) that’ll get responses: Description of your problem <!-- Use this section to describe the problem that you're encountering. Please include any screenshots or recordings of the problem you're running into.--> Description of steps you’ve taken to attempt to solve the issue <!-- Use this section to provide detail…

Also my apologies , you just want the hostname NOT the FQDN? is this correct? If so this maybe something you want.

string hostname()
Return the hostname (short form).

string hostname_fqdn()
Return the FQDN hostname. This function will return the short form if the FQDN hostname cannot be determined.

Look at my nxlog config file OUTPUT section, yours is incorrect.