NXLog User Guide

  
1
2
3
4
5
6
7
8
9
10
11
12

  
<Extension dns_parser>
    Module      xm_msdns
    EventLine   TRUE
    PacketLine  TRUE
    NoteLine    TRUE
</Extension>

<Input in>
    Module      im_file
    File        'C:\Server\dns.log'
    InputType   dns_parser
</Input>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

  
define EVENT_REGEX /(?x)(?<Date>\d+(?:\/\d+){2})\s \
                    (?<Time>\d+(?:\:\d+){2}\s\w+)\s \
                    (?<ThreadId>\w+)\s+ \
                    (?<Context>\w+)\s+ \
                    (?<InternalPacketIdentifier>[[:xdigit:]]+)\s+ \
                    (?<Protocol>\w+)\s+ \
                    (?<SendReceiveIndicator>\w+)\s \
                    (?<RemoteIP>[[:xdigit:].:]+)\s+ \
                    (?<Xid>[[:xdigit:]]+)\s \
                    (?<QueryType>\s|R)\s \
                    (?<Opcode>[A-Z]|\?)\s \
                    (?<QFlags>\[(.*?)\])\s+ \
                    (?<QuestionType>\w)\s+ \
                    (?<QuestionName>.*)/
define EMPTY_EVENT_REGEX /(^$|^\s+$)/
define DOMAIN_REGEX /\(\d+\)([\w-]+)\(\d+\)([\w-]+)/
define SUBDOMAIN_REGEX /\(\d+\)([\w-]+)\(\d+\)([\w-]+)\(\d+\)(\w+)/
define NOT_STARTING_WITH_DATE_REGEX /^(?!\d+\/\d+\/\d+).+/
define QFLAGS_REGEX /(?x)(?<FlagsHex>\d+)\s+ \
                     (?<FlagsCharCodes>\s+|([A-Z]{2}|[A-Z]))\s+ \
                     (?<ResponseCode>\w+)/

<Extension _json>
    Module  xm_json
</Extension>

<Input in>
    Module  im_file
    File    'C:\Server\dns.log'
    <Exec>
        # Drop entries that have empty lines
        if $raw_event =~ %EMPTY_EVENT_REGEX% drop();
        # Drop entries not starting with date
        if $raw_event =~ %NOT_STARTING_WITH_DATE_REGEX% drop();
        # Split entries into fields & define regular entries
        if $raw_event =~ %EVENT_REGEX%
        {
            $Regular = TRUE;
            $EventTime  = parsedate($Date + " " + $Time);
            $Raw = $raw_event;
            delete($date);
            delete($time);
            if $FlagsCharCodes =~ /^\s+$/ delete($FlagsCharCodes );
            # Convert domains from (8)mydomain(1)com to mydomain.com
            if $QuestionName =~ %DOMAIN_REGEX% $QuestionName = $1 + "." + $2;
            # Convert domains from (8)sub(8)mydomain(1)com to sub.mydomain.com
            if $QuestionName =~ %SUBDOMAIN_REGEX%
                $QuestionName = $1 + "." + $2 + "." +$3;

            # Set query flags
            if $QFlags =~ %QFLAGS_REGEX% delete($QFlags);

            # Set the query type
            if $QueryType =~ %EMPTY_EVENT_REGEX% $QueryType = "query";
            else $QueryType = "response";
        }
        else
        {
            $Regular = FALSE;
            $Raw = $raw_event;
        }
    </Exec>
</Input>

<Output out>
    Module  om_file
    Exec    to_json();
    File    'C:\output-dns-traffic.json'
</Output>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

  
define EVENT_REGEX /(?x)(?<Date>\d+(?:\/\d+){2})\s \
                   (?<Time>\d+(?:\:\d+){2}\s\w+)\s \
                   (?<ThreadId>\w+)\s+ \
                   (?<Context>\w+)\s+ \
                   (?<InternalPacketIdentifier>[[:xdigit:]]+)\s+ \
                   (?<Protocol>\w+)\s+ \
                   (?<SendReceiveIndicator>\w+)\s \
                   (?<RemoteIP>[[:xdigit:].:]+)\s+ \
                   (?<Xid>[[:xdigit:]]+)\s \
                   (?<QueryType>\s|R)\s \
                   (?<Opcode>[A-Z]|\?)\s \
                   (?<QFlags>\[(.*?)\])\s+ \
                   (?<QuestionType>\w+)\s+ \
                   (?<QuestionName>.*)\s+  \
                   (?<LogInfo>.+)\s+.+=\s \
                   (?<Socket>\d+)\s+ Remote\s+ addr\s \
                   (?<RemoteAddr>.+),\sport\s \
                   (?<PortNum>\d+)\s+Time\sQuery= \
                   (?<TimeQuery>\d+),\sQueued= \
                   (?<Queued>\d+),\sExpire= \
                   (?<Expire>\d+)\s+.+\( \
                   (?<BufLen>\d+)\)\s+.+\( \
                   (?<MsgLen>\d+)\)\s+Message:\s+ \
                   (?<Message>(?s).*)/

define HEADER_REGEX /(?x)(?<Date>\d+(?:\/\d+){2})\s \
                    (?<Time>\d+(?:\:\d+){2}\s\w+)\s \
                    (?<ThreadId>\w+)\s+ \
                    (?<Context>\w+)\s+ \
                    (?<InternalPacketIdentifier>[[:xdigit:]]+)\s+ \
                    (?<Protocol>\w+)\s+ \
                    (?<SendReceiveIndicator>\w+)\s \
                    (?<RemoteIP>[[:xdigit:].:]+)\s+ \
                    (?<Xid>[[:xdigit:]]+)\s \
                    (?<QueryType>\s|R)\s \
                    (?<Opcode>[A-Z]|\?)\s \
                    (?<QFlags>\[(.*?)\])\s+ \
                    (?<QuestionType>\w+)\s+ \
                    (?<QuestionName>.*)/

<Extension multiline>
    Module      xm_multiline
    HeaderLine  %HEADER_REGEX%
</Extension>

<Input filein>
    Module      im_file
    File        'C:\Server\dns.log'
    InputType   multiline
    <Exec>
        if $raw_event =~ %EVENT_REGEX%
        {
            $EventTime  = parsedate($Date + " " + $Time);
            delete($Date);
            delete($Time);
        }
    </Exec>
</Input>