http://docs.graylog.org/en/latest/pages/collector_sidecar.html
https://tom-henderson.github.io/2015/04/15/graylog.html
https://groups.google.com/forum/#!topic/graylog2/8Y5r46Yv_BI
# Global directives #
########################################
User root
#User nxlog
LogLevel INFO
########################################
# Modules #
########################################
<Extension gelf>
Module xm_gelf
</Extension>
<Input in1>
Module im_file
File “/var/log/messages”
SavePos TRUE
</Input>
<Input access_log>
Module im_file
File “/var/log/httpd/access_log”
Exec if $raw_event =~ /^(\S+) (\S+) (\S+) \[([^\]]+)\] \”(\S+) (.+) HTTP.\d\.\d\” (\d+) (\d+) \”([^\”]+)\” \”([^\”]+)\”/\
{ \
$Hostname = $1; \
if $3 != ‘-‘ $AccountName = $3; \
$EventTime = parsedate($4); \
$HTTPMethod = $5; \
$HTTPURL = $6; \
$HTTPResponseStatus = $7; \
$FileSize = $8; \
$HTTPReferer = $9; \
$HTTPUserAgent = $10; \
}
</Input>
<Output graylog_out>
Module om_udp
Host 192.168.100.111
Port 12201
OutputType GELF_UDP
# Routes #
########################################
<Route 1>
Path in1 => graylog_out
</Route>
<Route 2>
Path access_log => graylog_out
</Route>
http://www.emind.co/how-to/configure-nxlog-send-logs-to-graylog2/
Configure NXlog send logs to Graylog2
OS: CentOS 6.3 x86_64
Graylog2-Server Version: 0.11.0
Graylog2-web-interface Version: 0.11.0
NXlog Version: nxlog-ce-2.2
Hardware: Virtual Box 4.2.8
About
NXlog is a great tool to use to send your log files to graylog2 server.
In this guide a will show how to install nxlog with a simple configuration that set nxlog to listen for messages from a local file and send them to graylog2 server
Install NXlog
- Download and install nxlog
- Download and extract graylog2-radio
cd /usr/local/src wget http://sourceforge.net/projects/nxlog-ce/files/nxlog-ce-2.3.1027-1.x86_64.rpm yum localinstall nxlog-ce-*.rpm -y
- Configure NXlog to send logs to graylog2 server
vi /etc/nxlog.conf
######################################## # Global directives # ######################################## User nxlog Group nxlog LogFile /var/log/nxlog/nxlog.log LogLevel INFO ######################################## # Modules # ######################################## <Extension gelf> Module xm_gelf </Extension> <Input in> Module im_file File "/var/log/messages" </Input> <Output out> Module om_udp Host graylog2-server.local Port 12201 OutputType GELF </Output> ######################################## # Routes # ######################################## <Route r> Path in => out </Route>
- Configure NXlog to start at boot and start it
chkconfig nxlog on service nxlog start
That’s all. Now you can check your new log messages in graylog2 server
More guides in Graylog2 Category
Useful links:
