Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying without any luck to use NTSysLog in order to grab my network computers Security Logs and send them into a Log Service (Loggly in this case).

I can install and run NTSysLog from a Windows 7 Professional machine

enter image description here

from Loggly I only have Unix related setup help and they specify:

:: Syslog ::

For UDP, put this in /etc/syslog.conf:
     *.*    @logs.loggly.com:46031

To restart:
     /etc/init.d/syslogd restart


:: rsyslog ::

For UDP, put this in rsyslog.conf:
    *.*    @logs.loggly.com:46031

From this, How can I setup a Windows machine correctly without the need of setting up a Linux machine to be the SysLog server from then I would send the messages to the Log Service?

Setting the Primary Syslog Daemon as it shows in the image above, does not log it.

share|improve this question

2 Answers 2

So you are attempting to send your security logs unencrypted over the internet to a 3rd party service ?

Are you sure you wan to do this ? From a security perspective this is downright stupid.

Having said that: 3 things come to mind. (Even though I'm not familiar with NTSyslog.)

  • It seems you are assuming that the Windows Security Log is the same as Syslog events of type Security. Windows Logs have NOTHING to do with Syslog at all. Unless NTSyslog can convert between the 2 it is normal you don't see any events.
  • Does NTSyslog allow the use of an non-standard port-number (:46031) ?
  • Does your firewall allow UDP packets to be send out ?
share|improve this answer
    
1. The idea would be to secure the sent packages, this is just a simple test, so, for now, not that of a big problem; 2. NTSysLog does convert Windows Logs into one line that's why it's greatly used; 3. non-standard port ... need to recheck that!! 4. Firewall... grrr, forgot all about that !! –  balexandre Feb 4 '13 at 11:49
    
@balexandre syslog traffic is normally not encrypted. It is plain text across the line. It is possible to use SSL/TLS encryption using newer implementations, but this requires that both client and server can do this and implement this in the same way. You better check this out thoroughly before sending anything across the internet. –  Tonny Feb 4 '13 at 19:38

Take a look at nxlog. It can ship your eventlogs securely, there is TLS/SSL and HTTPs support. You could also format your logs in JSON and entirely skip the syslog format. I think these features will help integrate better with loggly. (Disclaimer: I'm affiliated with the project.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.