Networking

Unix and Linux network configuration. Multiple network interfaces. Bridged NICs. High-availability network configurations.

Applications

Reviews of latest Unix and Linux software. Helpful tips for application support admins. Automating application support.

Data

Disk partitioning, filesystems, directories, and files. Volume management, logical volumes, HA filesystems. Backups and disaster recovery.

Monitoring

Distributed server monitoring. Server performance and capacity planning. Monitoring applications, network status and user activity.

Commands & Shells

Cool Unix shell commands and options. Command-line tools and application. Things every Unix sysadmin needs to know.

Home » Security

Sending Windows Logs to Remote Syslog

Submitted by on July 6, 2019 – 11:21 am

Nothing fancy here: just a quick note on directing Windows event logs and select application logs to a remote syslog server.

For a Unix admin, searching Windows logs is a frustrating experience. Just looking at the event viewer GUI hurts my eyes. One option is to redirect those logs to a Unix-based remote syslog collector.

Download and install Nxlog version appropriate for your OS here. Download the nxlog.conf here and edit a couple of things:

When done editing nxlog.conf, don’t forget to restart the nxlog service from the Services control panel.

It is easier to find the application logs of interest by using the Linux subsystem for Windows. I have Kali Linux installed. Type this command in the terminal window to locate recently-modified application *.log files.

Then use these paths to add new <Input_watchfile#> sections to the nxlog.conf file. Once again, don’t forget to restart the nxlog service after editing the config file.

On your rsyslog server you will then be able to see stuff like:

 

Print Friendly, PDF & Email

Leave a Reply