# Windows server logs using NXLOG showing encrypted on Graylog **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** windows, nxlog, alert, timestamp, dashboards\ **Created:** [April 25, 2023, 9:17am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555 "2023-04-25T09:17:45Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [April 25, 2023, 9:17am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/1 "2023-04-25T09:17:46Z")
I recently configured some Windows 2016 servers with NXLOG and Graylog, but the logs are showing encrypted, like in the screenshot attached on Graylog. ![Windows Encrypted Log](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4fcb7558375a6e99540bd48fe8ba193d308eb397.png) OS Information: Red Hat, Inc. 1.8.0\_362 on Linux 3.10.0-1160.81.1.el7.x86\_64 - Package Version: Graylog 4.2.13+9c90b93 I have removed the configuration and redone the configuration, also tested it with another Windows server and restarted the server, and it is still the same. Please, anyone with experience with similar issues and remediation ideas? Thank you for your anticipated support. ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [April 25, 2023, 9:38am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/2 "2023-04-25T09:38:21Z")
Can you post your nxlog config, and the details of the input you are sending the logs to? ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [April 25, 2023, 9:46am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/3 "2023-04-25T09:46:04Z")
I think your NXLOG may be sending Unicode. You need to convert to UTF-8 > **[Character set conversion :: NXLog Documentation](https://docs.nxlog.co/userguide/configure/charset-conversion.html)** > > This topic explains how to normalize logs in NXLog by converting their character set. ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [April 25, 2023, 11:15am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/4 "2023-04-25T11:15:37Z")
I had tested with a different server before which the logs show on the Graylog unencrypted. ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [April 25, 2023, 11:16am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/5 "2023-04-25T11:16:58Z")
Please see attached. ![NXLOG1](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4838acdec5f2b58ecdeb9e8f2b7f0c25024b09d2.png) ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [April 25, 2023, 11:19am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/7 "2023-04-25T11:19:13Z")
Please see attached for the continuation. ![NXLOG2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fd6e264ef7791262a6fdd84f86b727e4f85f4c94.png) ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [April 25, 2023, 11:45am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/8 "2023-04-25T11:45:07Z")
Is there a reason you are using snare over syslog?gelf is the recomended encoding for sending from nxlog to Graylog. gelf will preserve all the individual fields so you dont need to parse them once recieved. You can see an example config here [Sample NXLog Windows Collection configuration](https://community.graylog.org/t/sample-nxlog-windows-collection-configuration/28514) You will of course also need to create a gelf input to receive it. ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [April 25, 2023, 1:53pm UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/9 "2023-04-25T13:53:28Z")
The reason for using Snare is to streamline logs for security activities. And I already have gelf input created, from which I receive logs from another Windows server unencrypted. ![GELF](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/1fb1daf1a9999cf19645443e418aca49d9ca15c8.png) ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [April 27, 2023, 7:09am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/10 "2023-04-27T07:09:35Z")
@Joel_Duffield please any further insights? ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [April 27, 2023, 8:43am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/11 "2023-04-27T08:43:39Z")
Did you try character conversion to UTF-8 as described here? > **[Character set conversion :: NXLog Documentation](https://docs.nxlog.co/userguide/configure/charset-conversion.html)** > > This topic explains how to normalize logs in NXLog by converting their character set. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 27, 2023, 9:13pm UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/12 "2023-04-27T21:13:21Z")
Hey @SodOB I agree with @patrickmann about converting the logs. Normally when you see logs like that its not in the right format, Either you have to use another input or convert the logs to the right format for that input. ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [May 2, 2023, 7:02am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/13 "2023-05-02T07:02:20Z")
Thank you for the support @patrickmann and @gsmith. The Windows logs are now received on Graylog unencrypted. ---
**Author:** ![SodOB](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SodOB](https://community.graylog.org/u/SodOB)\ **Post date:** [May 2, 2023, 7:03am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/14 "2023-05-02T07:03:04Z")
Thank you as the issue is resolved now. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 16, 2023, 7:03am UTC](https://community.graylog.org/t/windows-server-logs-using-nxlog-showing-encrypted-on-graylog/28555/15 "2023-05-16T07:03:21Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.