IIS 使用 NXLog CE 記錄傳送到 Graylog

由 Jason Cheng 教使用 NXLog CE 方式來傳送記錄到 log 主機

運行環境

本工作室環境都是在「Proxmox VE 」虛擬系統上架設，都是以「 LXC 」模式為主，除非有特殊狀況會告知使用「 VM 」模式

系統環境：Windows Server 2012 R2
Web 服務：IIS 8.0

安裝過程

首先到官方 NXLog CE 先下載安裝檔

安裝完之後再進到 C:\Program Files (x86)\nxlog\conf 目錄下編輯 nxlog.conf 或者先複製一份原預設值再來編輯，再將下方的內容填入到該設定檔裡

Panic Soft
#NoFreeOnExit TRUE

define ROOT     C:\Program Files (x86)\nxlog
define CERTDIR  %ROOT%\cert
define CONFDIR  %ROOT%\conf
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir  %ROOT%\data
Pidfile   %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data

#######################################################################
####                         EXTENTIONS                           #####
#######################################################################
<Extension _gelf>
    Module      xm_gelf
</Extension>
<Extension _json>
    Module      xm_json
</Extension>
#######################################################################
####                         IIS NXLOG                           ######
#######################################################################
<Extension w3c>
    Module xm_csv
    Fields $datetime, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $cs-Referer, $cs-host, $sc-status, $sc-substatus, $sc-win32-status, $time-taken
    FieldTypes string, string, string, string, string, string, string, string, string, string, string, string, string, string, string
    Delimiter ' '
    QuoteChar '"'
    EscapeControl TRUE
    UndefValue -
</Extension>

<Extension _exec>
    Module      xm_exec
</Extension>

<Extension _fileop>
    Module      xm_fileop

    # Check the size of our log file hourly, rotate if larger than 5MB
    <Schedule>
        Every   1 hour
        Exec    if (file_exists('%LOGFILE%') and \
                   (file_size('%LOGFILE%') >= 5M)) \
                    file_cycle('%LOGFILE%', 8);
    </Schedule>

    # Rotate our log file every week on Sunday at midnight
    <Schedule>
        When    @weekly
        Exec    if file_exists('%LOGFILE%') file_cycle('%LOGFILE%', 8);
    </Schedule>
</Extension>

<Input iis>
    Module   im_file
    File     "C:\inetpub\logs\LogFiles\W3SVC1\u_ex*"
    SavePos  TRUE
	# 忽略以#開頭的日誌行
    # 合併日期與時間為一個欄位
    # 解析為CSV格式
    # 通過xm_csv模塊對W3C擴展日誌進行解析
    # 將合併後的日期與時間作為EventTime（發生時間），並增加GMT標誌(+00:00)解決IIS8小時時差問題
    Exec if $raw_event =~ /^#/ drop();                              \
        else                                                       \
        {                                                          \
          $raw_event = replace($raw_event, ' ', '@', 1);           \
          w3c->parse_csv();                                        \
          $raw_event = replace($raw_event, ' ', "\t");             \
          $raw_event = replace($raw_event, '@', ' ', 1);           \
          $EventTime = parsedate(replace($datetime, '@', ' ', 1) + '+00:00'); \
        }
</Input>

<Output graylog>
    Module om_udp
    Host log伺服器位置
    Port 12202
    OutputType GELF
    Exec        $Hostname = hostname_fqdn();
        Exec        $raw_event =$Hostname + ' IIS-NXLOG ' + $raw_event;
        #Use the following line for debugging (uncomment the fileop extension above as well)
    #Exec file_write("C:\Program Files (x86)\nxlog\data\nxlog_output.log", $raw_event);
</Output>


<Route iis-to-graylog>
    Path        iis => graylog
</Route>
#######################################################################
####                         /IIS NXLOG                           #####
#######################################################################