Windows Event Log

前面说过如何在 windows 上利用 nxlog 传输日志数据。事实上，对于 windows 本身，也有类似 syslog 的设计，叫 eventlog。本节介绍如何处理 windows eventlog。

采集端配置

logstash 配置

  1. input {
  2.     eventlog {
  3.         #logfile =>  ["Application", "Security", "System"]
  4.         logfile =>  ["Security"]
  5.         type => "winevent"
  6.         tags => [ "caen" ]
  7.     }
  8. }

nxlog 配置

  1. ## This is a sample configuration file. See the nxlog reference manual about the
  2. ## configuration options. It should be installed locally and is also available
  3. ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
  5. ## Please set the ROOT to the folder your nxlog was installed into,
  6. ## otherwise it will not start.
  8. #define ROOT C:\Program Files\nxlog
  9. define ROOT C:\Program Files (x86)\nxlog
  11. Moduledir %ROOT%\modules
  12. CacheDir %ROOT%\data
  13. Pidfile %ROOT%\data\nxlog.pid
  14. SpoolDir %ROOT%\data
  15. LogFile %ROOT%\data\nxlog.log
  17. <Extension json>
  18.     Module    xm_json
  19. </Extension>    
  21. <Input in>
  22.     Module      im_msvistalog
  23. # For windows 2003 and earlier use the following:
  24. #   Module      im_mseventlog
  25.     Exec    to_json();
  26. </Input>
  28. <Output out>
  29.     Module      om_tcp
  30.     Host        10.66.66.66
  31.     Port        5140
  32. </Output>
  34. <Route 1>
  35.     Path        in => out
  36. </Route>

Logstash 解析配置

  1. input {
  2.   tcp {
  3.     codec => "json"
  4.     port => 5140
  5.     tags => ["windows","nxlog"]
  6.     type => "nxlog-json"
  7.   }
  8. } # end input
  10. filter {
  11.   if [type] == "nxlog-json" {
  12.     date {
  13.       match => ["[EventTime]", "YYYY-MM-dd HH:mm:ss"]
  14.       timezone => "Europe/London"
  15.     }
  16.     mutate {
  17.         rename => [ "AccountName", "user" ]
  18.         rename => [ "AccountType", "[eventlog][account_type]" ]
  19.         rename => [ "ActivityId", "[eventlog][activity_id]" ]
  20.         rename => [ "Address", "ip6" ]
  21.         rename => [ "ApplicationPath", "[eventlog][application_path]" ]
  22.         rename => [ "AuthenticationPackageName", "[eventlog][authentication_package_name]" ]
  23.         rename => [ "Category", "[eventlog][category]" ]
  24.         rename => [ "Channel", "[eventlog][channel]" ]
  25.         rename => [ "Domain", "domain" ]
  26.         rename => [ "EventID", "[eventlog][event_id]" ]
  27.         rename => [ "EventType", "[eventlog][event_type]" ]
  28.         rename => [ "File", "[eventlog][file_path]" ]
  29.         rename => [ "Guid", "[eventlog][guid]" ]
  30.         rename => [ "Hostname", "hostname" ]
  31.         rename => [ "Interface", "[eventlog][interface]" ]
  32.         rename => [ "InterfaceGuid", "[eventlog][interface_guid]" ]
  33.         rename => [ "InterfaceName", "[eventlog][interface_name]" ]
  34.         rename => [ "IpAddress", "ip" ]
  35.         rename => [ "IpPort", "port" ]
  36.         rename => [ "Key", "[eventlog][key]" ]
  37.         rename => [ "LogonGuid", "[eventlog][logon_guid]" ]
  38.         rename => [ "Message", "message" ]
  39.         rename => [ "ModifyingUser", "[eventlog][modifying_user]" ]
  40.         rename => [ "NewProfile", "[eventlog][new_profile]" ]
  41.         rename => [ "OldProfile", "[eventlog][old_profile]" ]
  42.         rename => [ "Port", "port" ]
  43.         rename => [ "PrivilegeList", "[eventlog][privilege_list]" ]
  44.         rename => [ "ProcessID", "pid" ]
  45.         rename => [ "ProcessName", "[eventlog][process_name]" ]
  46.         rename => [ "ProviderGuid", "[eventlog][provider_guid]" ]
  47.         rename => [ "ReasonCode", "[eventlog][reason_code]" ]
  48.         rename => [ "RecordNumber", "[eventlog][record_number]" ]
  49.         rename => [ "ScenarioId", "[eventlog][scenario_id]" ]
  50.         rename => [ "Severity", "level" ]
  51.         rename => [ "SeverityValue", "[eventlog][severity_code]" ]
  52.         rename => [ "SourceModuleName", "nxlog_input" ]
  53.         rename => [ "SourceName", "[eventlog][program]" ]
  54.         rename => [ "SubjectDomainName", "[eventlog][subject_domain_name]" ]
  55.         rename => [ "SubjectLogonId", "[eventlog][subject_logonid]" ]
  56.         rename => [ "SubjectUserName", "[eventlog][subject_user_name]" ]
  57.         rename => [ "SubjectUserSid", "[eventlog][subject_user_sid]" ]
  58.         rename => [ "System", "[eventlog][system]" ]
  59.         rename => [ "TargetDomainName", "[eventlog][target_domain_name]" ]
  60.         rename => [ "TargetLogonId", "[eventlog][target_logonid]" ]
  61.         rename => [ "TargetUserName", "[eventlog][target_user_name]" ]
  62.         rename => [ "TargetUserSid", "[eventlog][target_user_sid]" ]
  63.         rename => [ "ThreadID", "thread" ]
  64.     }
  65.     mutate {
  66.         remove_field => [
  67.                     "CurrentOrNextState",
  68.                     "Description",
  69.                     "EventReceivedTime",
  70.                     "EventTime",
  71.                     "EventTimeWritten",
  72.                     "IPVersion",
  73.                     "KeyLength",
  74.                     "Keywords",
  75.                     "LmPackageName",
  76.                     "LogonProcessName",
  77.                     "LogonType",
  78.                     "Name",
  79.                     "Opcode",
  80.                     "OpcodeValue",
  81.                     "PolicyProcessingMode",
  82.                     "Protocol",
  83.                     "ProtocolType",
  84.                     "SourceModuleType",
  85.                     "State",
  86.                     "Task",
  87.                     "TransmittedServices",
  88.                     "Type",
  89.                     "UserID",
  90.                     "Version"
  91.                     ]
  92.     }
  93.   }
  95. }