NXLog User Guide

  
1
2
3
4
5
6
7
8
9

  
<Extension w3c_parser>
    Module      xm_w3c
</Extension>

<Input iis_w3c>
    Module      im_file
    File        'C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.log'
    InputType   w3c_parser
</Input>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

  
<Extension w3c_parser>
    Module          xm_csv
    Fields          date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, \
                    s-port, cs-username, c-ip, cs(User-Agent), cs(Referer), \
                    sc-status, sc-substatus, sc-win32-status, time-taken
    FieldTypes      string, string, string, string, string, string, integer, \
                    string, string, string, string, integer, integer, integer, \
                    integer
    Delimiter       ' '
    EscapeChar      '"'
    QuoteChar       '"'
    EscapeControl   FALSE
    UndefValue      -
</Extension>

<Input iis_w3c>
    Module          im_file
    File            'C:\inetpub\logs\LogFiles\W3SVC*\u_ex*.log'
    <Exec>
        if $raw_event =~ /^#/ drop();
        else
        {
            w3c_parser->parse_csv();
            $EventTime = parsedate($date + "T" + $time + ".000Z");
        }
    </Exec>
</Input>

  
1
2
3
4
5
6
7
8
9

  
<Extension w3c_parser>
    Module      xm_w3c
</Extension>

<Input iis_http>
    Module      im_file
    File        'C:\Windows\System32\LogFiles\HTTPERR\httperr1.log'
    InputType   w3c_parser
</Input>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

  
<Extension iis_parser>
    Module      xm_csv
    Fields      ClientIPAddress, UserName, Date, Time, ServiceAndInstance, \
                ServerName, ServerIPAddress, TimeTaken, ClientBytesSent, \
                ServerBytesSent, ServerStatusCode, WindowsStatusCode, RequestType, \
                TargetOfOperation, Parameters
    FieldTypes  string, string, string, string, string, string, string, integer, \
                integer, integer, integer, integer, string, string, string
    UndefValue  -
</Extension>

<Input iis>
    Module      im_file
    File        'C:\inetpub\logs\LogFiles\W3SVC*\u_in*.log'
    <Exec>
        iis_parser->parse_csv();
        $EventTime = strptime($Date + " " + $Time, "%m/%d/%Y %H:%M:%S");
    </Exec>
</Input>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

  
<Input iis_ncsa>
    Module  im_file
    File    'C:\inetpub\logs\LogFiles\W3SVC*\u_nc*.log'
    <Exec>
        if $raw_event =~ /(?x)^(\S+)\ -\ (\S+)\ \[([^\]]+)\]\ \"(\S+)\ (.+)
                          \ HTTP\/\d\.\d\"\ (\S+)\ (\S+)/
        {
            $RemoteHostAddress = $1;
            if $2 != '-' $UserName = $2;
            $EventTime = parsedate($3);
            $HTTPMethod = $4;
            $HTTPURL = $5;
            $HTTPResponseStatus = $6;
            $BytesSent = $7;
        }
    </Exec>
</Input>

  
1
2
3
4
5
6
7
8
9

  
<Extension w3c_parser>
    Module      xm_w3c
</Extension>

<Input smtp>
    Module      im_file
    File        'C:\Windows\System32\LogFiles\SmtpSvc1\ex*.log'
    InputType   w3c_parser
</Input>

  
1
2
3
4
5
6
7
8
9

  
<Extension w3c_parser>
    Module          xm_w3c
</Extension>

<Input iis>
    Module          im_file
    include_stdout  %ROOT%\get_iis_log_paths.cmd
    InputType       w3c_parser
</Input>