Last updated 27th July, 2020
At OVHcloud, we love Microsoft products too. So it is important for us to provide you a way to send your Windows Logs to Logs Data Platform. All you need is 15 minutes and one software : NXLog. NXLog is one of the leader of the log management tools. Its configuration is fairly simple and can get you started in a few minutes.
For this tutorial you will need to have completed the following steps :
You can find NXLog, at its official website nxlog.co. Please go to the official website and download the latest version for Windows (2.10.2150 at the time of writing). Be sure to have Administrator rights before proceding. Once you have it, install it on your system. By default the program will install itself in C:\Program Files(x86)\nxlog\. Navigate to this folder to edit the configuration file nxlog.conf present in the folder conf.
To configure NXLog, you will need to copy and store the LDP cluster certificate. You can find it in the Home page.
Please put this file under the C:\Program Files(x86)\nxlog\cert folder.
The configuration is pretty much straightforward. Here is the configuration file that allows you to configure your NXLog.
## This is a sample configuration file. See the nxlog reference manual about the ## configuration options. It should be installed locally and is also available ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html ## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog define CERTDIR %ROOT%\cert Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log <Input in> Module im_msvistalog # For windows 2003 and earlier use the following: # Module im_mseventlog </Input> <Processor OVH_TOKEN> Module pm_null Exec $TOKEN='XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'; Exec rename_field("TOKEN","X-OVH-TOKEN"); </Processor> <Extension gelf> Module xm_gelf </Extension> <Output out> Module om_ssl Host <your_cluster>.logs.ovh.com Port 12202 CAFile %CERTDIR%\ldp.crt AllowUntrusted FALSE OutputType GELF_TCP </Output> <Route 1> Path in => OVH_TOKEN => out </Route>
Let's explain the few important points in this configuration :
- The line define CERTDIR %ROOT%\cert is mandatory to indicate to NXLog where it will find the certificate of Logs Data Platform.
- The Input part is the same as the default configuration. Do not touch it ;-).
- The Processor module is where the OVHcloud Token magic happens : Replace your token here.
- The Extension activate the built-in GELF module that encode the log in the GELF format
- The Output module is the one that will send the logs to Logs Data Platform by defining the CA certificate used to trust the server and the encoding used. Note that you will have to use the address of your assigned cluster. This is also where you use the path of the certificate downloaded just before. This module also define that we use the Gelf Encoding.
- The Route setting put all these things together by building a pipeline using the source, processing and the ouput modules.
You have two ways to start NXLog. The first one is to launch the main Executable : C:\Program Files(x86)\nxlog\nxlog.exe. This is convenient when you are pretty sure that your configuration is correct. But if you want to be able to start, stop or restart the nxlog service, It would be better to use the Windows Service Manager. This Manager is located deep in the Configuration Panel of Windows.
Go to Control Panel, then locate Administrative Tools and then double-click on Services to display the manager. In this menu you should find the service nxlog in the list. There is a start, stop and restart action available in the contextual menu (Right-click on it).
Excuse my French screenshot detailing where to find it:
If something bad happens, you will find the logs and a pretty good explanation in the file : C:\Program Files(x86)\nxlog\data\nxlog.log. If everything is correct you should find these kind of lines in the same file :
2016-04-08 19:53:26 INFO connecting to <your_cluster>.logs.ovh.com:12202 2016-04-08 19:53:26 INFO successfully connected to <your_cluster>.logs.ovh.com:12202
Jump to Graylog (use the Graylog access button in the Manager) and to the stream associated to your token to display your logs. As you can see, The Event Log format of windows is already structured and allows you immediately to analyze your services and processes.
I think that's pretty much it. I know, it didn't even take 10 minutes :-).
If you want to go further, don't hesitate to fly to the NXlog documentation
- Getting Started: Quick Start
- Documentation: Guides
- Community hub: https://community.ovh.com
- Create an account: Try it!