NXLog - Mezmo Docs

NXLog is the workhorse of Windows logging plugins. Mezmo ingests NXLog data by placing an OpenTelemetry (OTel) Collector between your Windows hosts and Mezmo. NXLog forwards Syslog-formatted events to the Collector’s syslog receiver over TLS, and the Collector relays them to Mezmo’s OpenTelemetry Source with the otlphttp exporter.

NXLog (om_ssl output)  -->  OpenTelemetry Collector (syslog receiver)  -->  Mezmo OTEL Source (otlphttp exporter)

Set Up the OpenTelemetry Collector

Log in to the Mezmo Web App, create (or open) a Pipeline, and add an OpenTelemetry Source. Note the ingestion key — you’ll use it as apikey.
Download the otelcol-contrib distribution, which includes the syslog receiver, from the OpenTelemetry website.
Create a config.yaml:

receivers:
  syslog:
    protocol: rfc5424
    tcp:
      listen_address: "0.0.0.0:CUSTOM_PORT"
      tls:
        cert_file: /path/to/cert.pem
        key_file: /path/to/key.pem

exporters:
  otlphttp/mezmo:
    endpoint: "https://logs.mezmo.com/otel"
    compression: gzip
    headers:
      apikey: "<YOUR_INGESTION_KEY>"

service:
  pipelines:
    logs:
      receivers: [syslog]
      exporters: [otlphttp/mezmo]

Start the Collector:

./otelcol-contrib --config /path/to/config.yaml

Configure NXLog

Point NXLog’s om_ssl output at the host and port where the Collector’s syslog receiver is listening, using the same certificate you configured on the Collector.

Panic Soft
#NoFreeOnExit TRUE

define ROOT     C:\\Program Files (x86)\\nxlog
define CERTDIR  %ROOT%\\cert
define CONFDIR  %ROOT%\\conf
define LOGDIR   %ROOT%\\data
define LOGFILE  %LOGDIR%\\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\\modules
CacheDir  %ROOT%\\data
Pidfile   %ROOT%\\data\\nxlog.pid
SpoolDir  %ROOT%\\data

<Extension _syslog>
    Module      xm_syslog
</Extension>

<Extension _exec>
    Module      xm_exec
</Extension>

<Extension json>
    Module	xm_json
</Extension>

<Input internal>
    Module im_internal
    Exec $Message = to_json();
</Input>

#######################################################################
##### This is just explicit version of internal input above ###########
#######################################################################
# <Input nxlog>
#     Module im_file
#     File '%LOGFILE%'
#     <Exec>
#         $Message = $raw_event;
#         if $Message == '' drop();
#         $SourceName = substr(file_name(), size('%LOGDIR%') + 1);
#     </Exec>
# </Input>
#######################################################################

# Define Directory for Making Substring Operation
define LOGFOLDER C:\\ProgramData\\logs

<Input filelog>
    Module im_file
    File '%LOGFOLDER%\\*.log'
    Recursive TRUE
    <Exec>
        $Message = $raw_event;
        if $Message == '' drop();
        $SourceName = substr(file_name(), size('%LOGFOLDER%') + 2);
    </Exec>
</Input>

<Input eventlog>
    Module im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id='0'>
                <!--Select Path='Application'>*</Select-->
                <Select Path='System'>*</Select>
                <!--Select Path='Security'>*</Select-->
            </Query>
        </QueryList>
    </QueryXML>
    Exec $Message = to_json();
</Input>

<Processor buffer>
    Module pm_buffer
    MaxSize 102400
    Type disk
</Processor>

<Output out>
    Module om_ssl
    Host <OTEL_COLLECTOR_HOST>
    Port CUSTOM_PORT
    CAFile %CERTDIR%\ca.pem
    Exec to_syslog_ietf();
</Output>

<Route 1>
    Path internal, filelog, eventlog => buffer => out
</Route>

You can add additional logfiles by creating a new <Input {name}> section that imitates the previous ones, and adding the name of that section to <Route 1> at the end.

Example for Tailing Additional Log Files

<Input newlog>
    Module im_file
    File '%LOGDIR%\\example.log'
    Exec $Message = to_json();
</Input>

⌘I