nxlog data (gelf) to graylog2 server

Question

I'm using a graylog2 vm to get my firewall syslogs and it runs quite well. Now I'd like to get some windows logs using nxlog and that doesn't work at all.

My guess is that my xml code in the conf file is wrong, but I've been wrong before.. Note : the VM and the windows server I want to get logs from are on the same network:

    ## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _syslog>
    Module      xm_gelf
</Extension>

<Input in>
    Module      im_msvistalog
# For windows 2003 and earlier use the following:
#   Module      im_mseventlog

Query <QueryList>\
  <Query Id="0" Path="Security">\
    <Select Path="Security">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="System">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-Diagnostics-Networking/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-Diagnostics-Performance/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-DiskDiagnostic/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-UAC/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-User Profile Service/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="HardwareEvents">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
  </Query>\
</QueryList>

</Input>


<EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data> 
  <Data Name="SubjectUserName">WIN-OUNNPISDHIG$</Data> 
  <Data Name="SubjectDomainName">WORKGROUP</Data> 
  <Data Name="SubjectLogonId">0x3e7</Data> 
  <Data Name="TargetUserSid">S-1-5-18</Data> 
  <Data Name="TargetUserName">SYSTEM</Data> 
  <Data Name="TargetDomainName">NT AUTHORITY</Data> 
  <Data Name="TargetLogonId">0x3e7</Data> 
  <Data Name="LogonType">5</Data> 
  <Data Name="LogonProcessName">Advapi</Data> 
  <Data Name="AuthenticationPackageName">Negotiate</Data> 
  <Data Name="WorkstationName" /> 
  <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x1dc</Data> 
  <Data Name="ProcessName">C:\Windows\System32\services.exe</Data> 
  <Data Name="IpAddress">-</Data> 
  <Data Name="IpPort">-</Data> 
</EventData>

<Output out-12201>
    Module      om_udp
    Host        192.168.0.4
    Port        12201
    OutputType  GELF
   </Output>


<Route r>
    Path        in => out-12201
</Route>

The problem is my gelf udp input is running but nothing shows up in sources... Do you see anything wrong ?

EDIT / After further investigations and help. I modified the nxlog.conf as :

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension gelf>
    Module      xm_gelf
</Extension>

<Input in>
Module      im_msvistalog
# For windows 2003 and earlier use the following:
# Module      im_mseventlog

Query <QueryList>\
  <Query Id="0" Path="Security">\
    <Select Path="Security">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="System">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-Diagnostics-Networking/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-Diagnostics-Performance/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-DiskDiagnostic/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-UAC/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-User Profile Service/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
    <Select Path="HardwareEvents">*[System[(Level=1  or Level=2 or Level=3)]]</Select>\
  </Query>\
</QueryList>

</Input>


<Output out>
    Module      om_udp
    Host        192.168.0.4
    Port        12201
    OutputType  GELF
   </Output>


<Route r>
    Path        in => out
</Route>

I' still not seeing anything in graylog except my supposedly running input.

Answer 1

How did that <EventData> stuff end up in your nxlog.conf? Once that's cleaned up you should check nxlog.log for potential errors if it still doesn't work.