NXLog User Guide

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

  
<Extension _json>
    Module  xm_json
</Extension>

<Extension _syslog>
    Module  xm_syslog
</Extension>

<Input module_logging>
    Module  im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id="0" Path="Microsoft-Windows-PowerShell/Operational">
                <Select Path="Microsoft-Windows-PowerShell/Operational">
                    *[System[EventID=4103]]</Select>
            </Query>
        </QueryList>
    </QueryXML>
    Exec    $Message = to_json(); to_syslog_bsd();
</Input>

<Output tcp>
    Module  om_tcp
    Host    10.12.1.1
    Port    514
</Output>

  
1
2
3
4
5
6
7
8
9
10
11
12
13

  
<Input script_block_logging>
    Module  im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id="0" Path="Microsoft-Windows-PowerShell/Operational">
                <Select Path="Microsoft-Windows-PowerShell/Operational">
                    *[System[(Level=0 or Level=1 or Level=2 or Level=3 or Level=4)
                             and ((EventID &gt;= 4104 and EventID &lt;= 4106))]]
                </Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

  
define TRANSCRIPTS_DIR C:\powershell

<Extension transcript_parser>
    Module      xm_multiline
    # Use this if invocation headers are ON (recommended)
    HeaderLine  /^\*{22}$/
    # Use this if invocation headers are OFF (not recommended)
    #HeaderLine  /^(\*{22}$|PS[^>]*>)/
    <Exec>
        $raw_event =~ s/^\xEF\xBB\xBF//;
        if get_var('include_next_record') and $raw_event =~ /^\*{22}$/
        {
            set_var('include_next_record', FALSE);
            $raw_event =~ s/^\*//;
        }
        else if $raw_event =~ /^Command start time: \d{14}$/
            set_var('include_next_record', TRUE);
    </Exec>
</Extension>

<Extension transcript_header_parser>
    Module          xm_kvp
    KVPDelimiter    \n
</Extension>

<Input transcription>
    Module      im_file
    File        '%TRANSCRIPTS_DIR%\\*PowerShell_transcript.*'
    InputType   transcript_parser
    <Exec>
        # Add file name as field to event record
        $File = file_name();

        # Drop extra separator line events
        if $raw_event =~ /^\*{22}$/
            drop();

        # Parse header and footer entries
        else if $raw_event =~ /(?x)^\*{22}\r\n
            (?<Message>Windows\ PowerShell\ transcript\ (start|end)\r\n
            (?<KVP>.*))$/s
        {
            $KVP =~ s/\r//g;
            transcript_header_parser->parse_kvp($KVP);
            delete($KVP);
            if ${Start time}
                $EventTime = strptime(${Start time}, '%Y%m%d%H%M%S');
            else
                $EventTime = strptime(${End time}, '%Y%m%d%H%M%S');
        }

        # Parse command entries with invocation headers
        else if $raw_event =~ /(?x)^\*{22}\r\n
            (?<Part1>Command\ start\ time:\ (?<EventTime>\d{14})\r\n)
            (?<Part2>\*{21}\r\nPS[^>]*>\ ?
                     (?<Command>[^\r\n]+)(\r\n(?<Output>.+))?)$/s
        {
            $Message = $Part1 + '*' + $Part2;
            delete($Part1);
            delete($Part2);
            $EventTime = strptime($EventTime, '%Y%m%d%H%M%S');
        }

        # Parse command entries without invocation headers
        else if $raw_event =~ /(?x)^PS[^>]*>\ ?
             (?<Command>[^\r\n]+)(\r\n(?<Output>.+))?$/s
            $Message = $raw_event;
        else log_warning('Failed to parse transcript entry');
    </Exec>
</Input>