10

We currently use Nxlog on all of our DCs and send that data to a central syslog-ng server. Due to dealing with the agent on each computer and the need for additional agents that only support reading the event viewer, we are debating about using WEF to forward all DC logs to a few servers so we have fewer agents to deal with. In theory this sounds fine, but as I started to read into it, I don't see any ability for HA or clustering. I could probably front end it with a load balance and round robin spray the events to the 5 or so servers on the back end but not sure if that would work the way I want it to.

Does anyone have experience with using WEF in a fairly large environment? We receive around 200 million Windows event logs a day and need to increase the logging level. Also, we have the need for the logs to be as near real time as possible so with this scale, has anyone ran into performance issue on either the DC forwarding logs or latency of the collectors receiving them?

Thanks for your help and input.

  • The article below has some good information on how to setup an HA pair, but you would receive duplicates on each server instead of being a true round-robin type setup. This would work if you only care about HA, but I care about not getting dups as well so I don't think it'll do what I want it to do. (technet.microsoft.com/itpro/windows/keep-secure/…) – Eric May 2 '16 at 16:55
  • not really answering your question, but have you tried using a config management system like [saltstack (free windows clients!), puppet, chef, etc] for provisioning the nxlog agents? In my past life, I used salt to deploy nxlog and configuration, it made it a snap to manage all the nxlog agents. – Steve Butler Nov 22 '16 at 22:25
1

I would highly recommend switching all your agents to elastic beats. I have used nxlog in the past and it simply does not do everything as nice as elastic beats have.

Plus they are written in GO so no dependancies needed.

Syslog-NG is great too, but I've since switched to logstash here as well, it supports clustering, failover, queues, and many exports different (like to graylog or splunk).

Lastly, we deploy our beats to windows and linux with Ansible.

| improve this answer | |
-2

You might want to consider a tool like Graylog (https://www.graylog.org/features) to manage and monitor your enterprise logging environment.

| improve this answer | |
  • I think the asker really wanted some insight on the use of WEF - did you start using Graylog after running into issues with WEF (or pick it over WEF for a specific reason)? – iwaseatenbyagrue Mar 21 '17 at 7:22
  • This is so not relevant to the question.. – willemdh Apr 4 '18 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.