Specific windows events log (EventID 104 etc) not arriving

[Gosh]

Hello,

I have the graylog sidecar and nxlog installed and configured on my DC in order to send windows events log, the issue is, although i receive the logs (Application,Security,Setup) properly, i don’t receive all System logs properly, specifically the 104 event id, for event log cleared, although the event id is actually exists and appears in the System log when i check it on Event Viewer.

I am using collector sidecar version 0.1.3 and the DC is a Windows Server 2008r2.

Am i missing anything? Do i need to configure anything else, in the graylog web ui or something?

Thank you

[jtkarvo]

What level of logs have you specified in nxlog conf query element? 104 might be on such a low level, that the default settings of nxlog might not grab them and you need to make your own QueryList in the input module config.

[Gosh]

Hi jtkarvo,

I have tried the following options:
In the graylog web ui, under “Configure NXLog Inputs”:
Channel is empty and Query is empty.

Under “Define NXLog Snippets” i am using the following:

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

Module xm_syslog Module im_msvistalog

This is really strange…when i explicitly set/type “System” in the Channel, the log arrives properly. But only system logs of course.
I am really confused, i though that leaving Channel empty will bring events from all sources?

How can i use more than one channel in the Channel field?

[jtkarvo]

you can use Querylist

For example, this source: https://serverfault.com/questions/543494/query-specific-logs-from-event-log-using-nxlog has the following example:

Query   <QueryList>\
        <Query Id="0">\
            <Select Path="Security">*</Select>\
            <Select Path="System">*[System/Level=4]</Select>\
            <Select Path="Application">*[Application/Level=2]</Select>\
            <Select Path="Setup">*[System/Level=3]</Select>\
            <Select Path='Windows PowerShell'>*</Select>\
        </Query>\
    </QueryList>

[Gosh]

Thank you,

So should i leave “Channel” empty and just put the above query to the “Query”?

[jtkarvo]

I think the default channel should be OK.

You need to customize the query according to your own needs. That example and link just show an example.

Edit: you can test the query with the event viewer: there is a “create custom view” option, where you can test the query first; then when you see it works, use it in nxlog configuration.

[Gosh]

Thank you jtkarvo, much appreciated