Questions[nxlog](server)

I'm trying to install a NxLog collector on a Graylog client machine. The Graylog and associated infra (elastic and mongodb) is running just fine.

The install client is a Windows Server 2019 DC ("secondary"/"agent"/"respondent"? the not master new terminology). When I install NxLog, all is fine (the folder with files is created, and the service nxlog uninstalled). When I install Graylog, the "graylog-sidecar" service is installed, but the "graylog-collector-nxlog" service isn't.

The official docs do not cite which windows services are required at all.

All our other windows machines use the very same installer script and deploy the same two windows services: graylog-sidecar and graylog-collector-nxlog.

Am I doing something wrong? How to install the graylog-collector-nxlog service?

I am following the instructions for NXLog here: https://nxlog.co/documentation/nxlog-user-guide/linux-logs.html#linux_logs_forwarding_socket_example under 80.2 about forwarding syslog messages to NXLog.

It specifically states to restart NXLog and then rsyslog so that NXlog can create the socket before rsyslog tries to write to it.

My question is, during a reboot, and across different versions of Linux, it is ambiguous as to which service will start first, and my guess is that syslog may start first. What will happen if rsyslog starts before nxlog? Will rsyslog recover and start writing to the socket after nxlog starts and creates it?

I've got nxlog on my Windows servers shipping logs to Logstash (JSON-formatted). I want to clone off the security events to a SIEM, so I added the logic to catch certain Windows Event IDs:

Even though the "Windows Event Log" tag gets applied (via "add_tag"), the "Windows Security Event" is never added, even when I review the logs and find an EventID like 4624.

For reference here's the full plain-text logstash.conf:

input {tcp{port=>1514}}
filter {
        if "im_msvistalog" in [message] {
                json {source => "message"}
                mutate {add_tag => "Windows Event Log"}
                if [EventID]=="4688" or [EventID]=="592" or [EventID]=="4624" or [EventID]=="528" or [EventID]=="540" or [EventID]=="5140" or [EventID]=="560" or [EventID]==5156 or [EventID]=="7045" or [EventID]=="601" or [EventID]=="4663" or [EventID]=="567" { 
                        mutate {add_tag => "Windows Security Event"}
                }
        }
}
output {stdout{codec=>rubydebug}}

Edit: Here's what the output looks like:

I can't configure NXlog to send Windows Event Logon logs. the logs are created before NXlog starts, so NXlog needs to remember When was the last time that he grabbed the Event logs.
The problem occurs when I try to use the "savePos" directive in my configuration:

This directive takes a boolean value of TRUE or FALSE and specifies whether the file position should be saved when nxlog exits. The file position will be read from the cache file upon startup. The file position is saved by default if this directive is not specified in the configuration. Even if SavePos is enabled, it can be explicitly turned off with the NoCache directive.

(from the doc).

But NXlog never writes the position (or anything else) to the cache.
I'm not using the noCache, and I didn't find anything on the web.

My NXlog configuration (generated by Graylog2):

define ROOT C:\Program Files (x86)\nxlog
<Extension gelf>
Module xm_gelf
</Extension>

<Extension syslog>
  Module xm_syslog
</Extension>

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

LogLevel INFO

<Extension logrotate>
    Module  xm_fileop
    <Schedule>
        When    @daily
        Exec    file_cycle('%ROOT%\data\nxlog.log', 7);
    </Schedule>
</Extension>

<Input 57849fe093a38e030db3e1d7>
    Module im_msvistalog
    PollInterval 2
    SavePos True
    ReadFromLast True

</Input>

<Output 57849aa293a38e030db3dc55>
    Module om_udp
    Host 10.200.68.102
    Port 12201
    OutputType  GELF
    Exec $short_message = $raw_event; 
# Avoids truncation of the short_message field.
    Exec $gl2_source_collector = '8d8925b7-f1c0-40ae-a1ed-e918432e2125';
    Exec $Hostname = hostname_fqdn();
</Output>

<Route route-0>
  Path 57849fe093a38e030db3e1d7 => 57849aa293a38e030db3dc55
</Route>

I am attempting to use nxlog to read and parse IIS logs on Windows Server 2008 r2. Because I have particular requirements for these logs, I would like to use om_exec to send the log entries to a custom tool, where I will do the required work and process them as I need to. My block looks like this:

<Output streamout>
    Module      om_exec
    Command     'dump_input.exe'
</Output>

This configuration results in this error message:

ERROR couldn't execute process 'dump_input.exe'; The parameter is incorrect.

I have tried fully-qualifying the command name, using well-known commands (such as cmd.exe), non-existent commands, anything, and the error is always the same.

Does om_exec work on Windows, and if so, how can I use it?