108. Extension Modules
Extension modules do not process log messages directly, and for this reason their instances cannot be part of a route. These modules enhance the features of NXLog in various ways, such as exporting new functions and procedures or registering additional I/O reader and writer functions (to be used with modules supporting the InputType and OutputType directives). There are many ways to hook an extension module into the NXLog engine, as the following modules illustrate.
-
Remote Management (xm_admin) – Provides secure remote administration capabilities
-
AIX Auditing (xm_aixaudit) – Parses events in the AIX Audit format
-
Apple System Logs (xm_asl) – Registers an InputType for parsing ASL files
-
Basic Security Module Auditing (xm_bsm) – Registers an InputType for parsing BSM Auditing files
-
Common Event Format (xm_cef) – Generates and parses data in the Common Event Format
-
Character Set Conversion (xm_charconv) – Provides tools for converting strings between character sets
-
Delimiter-Separated Values (xm_csv) – Parses and generates comma- and delimiter-separated data
-
External Programs (xm_exec) – Supports execution of a program or script during processing
-
File Lists (xm_filelist) – Provides file-based blacklisting and whitelisting functionality
-
File Operations (xm_fileop) – Provides tools for manipulating files and implementing retention policies
-
GELF (xm_gelf) – Registers reader and writer functions for processing logs in the Graylog Extended Log Format
-
Grok (xm_grok) – Supports the use of Grok patterns for parsing events
-
JSON (xm_json) – Parses and generates log data in JSON format
-
Key-Value Pairs (xm_kvp) – Parses and generates data formatted as key-value pairs
-
LEEF (xm_leef) – Parses and generates data in the Log Event Extended Format
-
Microsoft DNS Server (xm_msdns) – Parses debug logs generated by Microsoft DNS Server
-
Multi-Line Parser (xm_multiline) – Parses log messages that span multiple lines
-
NetFlow (xm_netflow) – Registers an InputType for parsing NetFlow data
-
Radius NPS (xm_nps) – Parses log data in the Microsoft Radius NPS Database Format
-
Pattern Matcher (xm_pattern) – Performs efficient pattern matching with an XML pattern database file
-
Perl (xm_perl) – Provides a Perl API and supports calling a Perl subroutine during processing
-
Python (xm_python) – Provides a Python API and supports calling a Python function during processing
-
Resolver (xm_resolver) – Provides functions for resolving IP addresses, user IDs, group IDs, and their names
-
Rewrite (xm_rewrite) – Implements event field whitelisting and blacklisting; renames fields
-
Ruby (xm_ruby) – Provides a Ruby API and supports calling a Ruby method during processing
-
SNMP Traps (xm_snmp) – Registers an InputType for parsing SNMP trap messages
-
Remote Management (xm_soapadmin) – Provides secure remote administration capabilities
-
Passwords on Stdin (xm_stdinpw) – Reads passwords on standard input
-
Syslog (xm_syslog) – Parses and generates log data in the various Syslog formats
-
W3C (xm_w3c) – Parses log data in the W3C Extended Log File Format and similar formats
-
WTMP (xm_wtmp) – Registers an InputType for parsing binary wtmp files
-
XML (xm_xml) – Parses and generates log data in XML format