Hello all! For a brief background, I walked into this (literal) job position picking up where the previous employee left off mid-setting up a graylog server. I’ve gotten it up and running, found an nxlog agent he tried to get working and have it running; Life is wonderful.
We have an estimated 20 servers I’d like to be collecting data from, specifically event logs from Windows servers.
From what I’ve read doing research, it appears all this can be done with one input as I’m looking for the same data (event logs) from multiple servers, and all this would be done on one port (for sake of ease, we’ll say I’m using 12201, the default for gelf_TCP which is what was in place already (though not on that port).
The problem is, I’ve gone to data_collection_server_2, installed nxlog, copied the conf to the proper folder, restarted the service and data does not appear to be getting sent to graylog. It was easy to see when the 1st data_collection server made contact as there was input activity, but it is harder to notice additional servers. Am I just not waiting long enough for data to appear? I wait a bit, see nothing, then create a second input in graylog for (the same thing) just with the new windows server name as it’s name and a new port, edit the port on the data_collection_server_2, and shortly thereafter the new input is getting data.
From what I read, 1 input in graylog is good for many/all servers that are all using that same agent (or whatever, to be fair I don’t really know/understand all the different input collection things, just appears myt predecessor chose gelf_tcp/nxlog as it grabs windows events) and should allow all servers to dump their event logs on the graylog via the same port assigned to that input. Is this accurate?
In addition to said event logs, what else does the community recommend I gather (what CAN be gathered) from Windows servers that could/might be of use and how would I go about including it? Below is my existing conf file for reference…
–File added as an upload attachment because the structuring kept making weird things happen in the actual post lol–
–never mind, cannot attach non-image files?@?@! Guess I’ll paste it in here as a screenshot otherwise it’s going to look weird and messed up but is now nearly useless to edit/comment on
Thanks so much in advance, really appreciate it!