NXLog User Guide

108.19. Radius NPS (xm_nps)

This module provides functions and procedures for processing data in NPS Database Format stored in files by Microsoft Radius services. Internet Authentication Service (IAS) is the Microsoft implementation of a RADIUS server and proxy. Internet Authentication Service (IAS) was renamed to Network Policy Server (NPS) starting with Windows Server 2008. This module is capable of parsing both IAS and NPS formatted data.

NPS formatted data typically looks like the following:

"RasBox","RAS",10/22/2006,09:13:09,1,"DOMAIN\user","DOMAIN\user",,,,,,"192.168.132.45",12,,"192.168.132.45",,,,0,"CONNECT 24000",1,2,4,,0,"311 1 192.168.132.45 07/31/2006 21:35:14 749",,,,,,,,,,,,,,,,,,,,,,,,,,,,"MSRASV5.00",311,,,,
"RasBox","RAS",10/22/2006,09:13:09,3,,"DOMAIN\user",,,,,,,,,,,,,,,,,4,,36,"311 1 192.168.132.45 07/31/2006 21:35:14 749",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"0x00453D36393120523D3020563D33",,,
"RasBox","RAS",10/22/2006,09:13:13,1,"DOMAIN\user","DOMAIN\user",,,,,,"192.168.132.45",12,,"192.168.132.45",,,,0,"CONNECT 24000",1,2,4,,0,"311 1 192.168.132.45 07/31/2006 21:35:14 750",,,,,,,,,,,,,,,,,,,,,,,,,,,,"MSRASV5.00",311,,,,

For more information on the NPS format see the Interpret NPS Database Format Log Files article on Microsoft TechNet.

108.19.1. Configuration

The xm_nps module accepts only the common module directives.

108.19.2. Procedures

The following procedures are exported by xm_nps.

parse_nps();: Parse the $raw_event field as NPS input.
parse_nps(string source);: Parse the given string as NPS format.

108.19.3. Examples

Example 514. Parsing NPS Data

The following configuration reads NPS formatted files and converts the parsed data into JSON.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

  <Extension nps>
    Module      xm_nps
</Extension>

<Extension json>
    Module      xm_json
</Extension>

<Input filein>
    Module      im_file
    File        'C:\logs\IAS.log'
    Exec        parse_nps();
</Input>

<Output fileout>
    Module      om_file
    File        'C:\out.json'
    Exec        to_json();
</Output>

<Route nps_to_json>
    Path        filein => fileout
</Route>