NXLog User Guide

This mandatory directive accepts a URL address. This address is sent to the client to notify it where the events should be sent. For example, Address https://nxlogserver.domain.corp:5985/wsman.

This mandatory directive specifies the address of the interface where the module should listen for client connections. Normally the any address 0.0.0.0 is used.

This boolean directive defines whether the module should store raw XML-formatted event data. If set to TRUE, the module stores raw XML data in the $EventXML field. By default, the value is set to FALSE, and the $EventXML field is not added to the event record.

This optional directive specifies the reconnection interval. The default value is PT60.0S (60 seconds).

This optional directive specifies the maximum number of reconnection attempts. The default is 5 attempts. If the client exceeds the retry count it will consider the subscription to be stale and will not attempt to reconnect.

This optional directive can be used to specify a duration after which the subscription will expire, or an absolute time when the subscription will expire. By default, the subscription will never expire.

Heartbeats are dummy events that do not appear in the output. These are used by the client to signal that logging is still functional if no events are generated during the specified time period. The default heartbeat value of PT3600.000S may be overridden with this optional directive.

This boolean directive specifies that the remote connection should be allowed without certificate verification. If set to TRUE the remote will be able to connect with an unknown or self-signed certificate. The default value is FALSE: all HTTPS connections must present a trusted certificate.

This specifies the path to a directory containing certificate authority (CA) certificates, which will be used to check the certificate of the remote HTTPS client. The certificate filenames in this directory must be in the OpenSSL hashed format. A remote’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.

This specifies the path of the certificate authority (CA) certificate, which will be used to check the certificate of the remote HTTPS client. To trust a self-signed certificate presented by the remote (which is not signed by a CA), provide that certificate instead.

This specifies the path of the certificate file to be used for the HTTPS handshake.

This specifies the path of the certificate key file to be used for the HTTPS handshake.

This specifies the path to a directory containing certificate revocation lists (CRLs), which will be consulted when checking the certificate of the remote HTTPS client. The certificate filenames in this directory must be in the OpenSSL hashed format.

This specifies the path of the certificate revocation list (CRL) which will be consulted when checking the certificate of the remote HTTPS client.

With this directive, a password can be supplied for the certificate key file defined in HTTPSCertKeyFile. This directive is not needed for passwordless private keys.

This optional directive can be used to set the permitted SSL cipher list, overriding the default. Use the format described in the ciphers(1ssl) man page.

This directive can be used to set the allowed SSL/TLS protocol(s). It takes a comma-separated list of values which can be any of the following: SSLv2, SSLv3, TLSv1, TLSv1.1, and TLSv1.2. By default, the TLSv1, TLSv1.2, and TLSv1.2 protocols are allowed. Note that the OpenSSL library shipped by Linux distributions may not support SSLv2 and SSLv3, in which case these will not work even if enabled with HTTPSSSSLProtocol.

This boolean directive can be used to turn on logging of connections. Since WEF connections can be quite frequent and excessive it could generate a lot of noise. On the other hand it can be useful to troubleshoot clients. This is disabled by default.

This optional directive specifies the maximum number of event records to be batched by the client. If this is not specified the default value is decided by the client.

This optional directive can be used to set a limit on the size of the allowed responses, in bytes. The default size is 153600 bytes. Event records exceeding this size will be dropped by the client and replaced by a drop notification.

This optional directive specifies the maximum amount of time allowed to elapse for the client to batch events. The default value is PT30.000S (30 seconds).

This specifies the port on which the module will listen for incoming connections. The default is port 5985.

This boolean directive allows you to enable data compression when sending data over the network. The compression mechanism is based on the zlib compression library. If the directive is not specified, it defaults to FALSE (the compression is disabled).

This directive specifies the query for pulling only specific EventLog sources. See the MSDN documentation about Event Selection. Note that this directive requires a single-line parameter, so multi-line query XML should be specified using line continuation:

  
1
2
3
4
5

  
Query <QueryList>                                              \
        <Query Id='1'>                                         \
          <Select Path='Security'>*[System/Level=4]</Select>   \
        </Query>                                               \
      </QueryList>

This directive is the same as the Query directive above, except it can be used as a block. Multi-line XML queries can be used without line continuation, and the XML Query can be directly copied from Event Viewer.

  
1
2
3
4
5
6
7

  
<QueryXML>
  <QueryList>
    <Query Id='1'>
      <Select Path='Security'>*[System/Level=4]</Select>
    </Query>
  </QueryList>
</QueryXML>

The default value of NXLog Subscription may be overridden by with this optional directive. This name will appear in the client logs.