> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/collect-data-using-syslog/collect-data-from-nxlog-for-windows-via-syslog.md). # Collect data from NXLog for Windows via Syslog {% hint style="info" %} See the changelog of the **Syslog** Listener [here](/listeners-changelog/syslog-listener.md). {% endhint %} ## Overview The following article outlines a basic data flow from your activity and events generated by **NXLog for Windows** to **Onum** using the **Syslog** Listener**.** ## Prerequisites If you're using TLS authentication, [contact Onum](broken://spaces/cSjT21I4EUhzghjc1rER/pages/nW8oZycpfVthtI5KYdQs) to get the cert information needed for TLS communication. The NXLog configuration file (nxlog.conf) requires specific modules and directives to properly format and forward Windows events to the **Syslog** Listener: ### Key Components: * **Input Module (im\_msvistalog)**: Collects Windows Event Logs from specified channels * **Output Module (om\_tcp/om\_udp)**: Sends formatted logs to Onum's Syslog Listener * **Processor Module (pm\_transformer)**: Converts Windows events to Syslog format * **Extension Modules**: Provides additional functionality (xm\_syslog, xm\_json) {% hint style="info" %} Please note that the form may look different if you are using this Listener in a cloud environment. For more information on this, see the main article on [Collecting data using Syslog](/listeners/listener-integrations/collect-data-using-syslog.md). The steps will be the same, just make sure to enter the Onum URL in the NXLog configuration. {% endhint %} ## Onum Setup {% stepper %} {% step %} Log in to your Onum tenant and click **Listeners > New listener**. {% endstep %} {% step %} Double-click the **Syslog** Listener. {% endstep %} {% step %} Enter a **Name** for the new Listener. Optionally, add a **Description** and some **Tags** to identify the Listener. {% endstep %} {% step %} Enter the required **Port** and **Protocol** (**TCP** or **UDP**). For cloud-based Onum installations, the **Socket** and **Protocol** sections are not visible (**port** `443` and **Protocol** `TCP` are used by default). If you see it, enter the required port in the **Port** field. {% hint style="warning" %} NXLog connects outbound to the port specified in the configuration file. If you need to change the port, modify the `Port` directive in the `` section of your nxlog.conf file. {% endhint %} While UDP 514 is the standard, some implementations may use TCP 514 or other ports, depending on specific configurations or security requirements. To determine the syslog port value, check the configuration settings of your syslog server or consult the documentation for your specific device or application. {% endstep %} {% step %} Choose the required **Framing Method**, which refers to how characters are handled in log messages sent via the Syslog protocol. Choose between: * **Auto-Detect** - automatically detect the framing method using the information provided. * **Non-Transparent Framing (newline)** - the **newline characters** `(\n)` within a log message are **preserved as part of the message content** and are not treated as delimiters or boundaries between separate messages. * **Non-Transparent Framing (zero)** - refers to the way **zero-byte** characters are handled. Any **null byte** (`\0`) characters that appear within the message body are **preserved as part of the message and** are not treated as delimiters or boundaries between separate messages. * **Non-Transparent Framing (custom)** - choose this option if you need to use vendor-specific or custom approaches to frame syslog messages rather than the standard framing methods. You must enter the specific character(s) that will mark the end of each syslog message in the **Custom trailer characters parameter** that appears. * **Octet Counting (message length)** - the Syslog message is preceded by a count of the length of the message in octets (bytes). {% endstep %} {% step %} In cloud-based Onum installations, the **TLS** configuration section is not visible. In these setups, Onum automatically manages **TLS** certificates, eliminating the need for manual configuration. If you see this section, you must enter the required **Certificate**, **Private key** and **CA Chain.** Learn how to generate these self-signed certificates in [this article](https://docs.onum.com/usecases/routing/crowdstrike-integration/self-signed-ssl-tls-certificates-creation). Once you have them, click **New secret** in each field and add the corresponding values. **Now there are two possible scenarios:** If you didn't enter your **TLS** certificates, when you click **Create listener** you'll see the **Network configuration** screen, which shows the **Address** and **Port** needed to communicate with Onum. Here you will download the certificate (see the[ steps after creation to do this](#download-certificate)). {% hint style="info" %} You can access all this information in the Listener details after creation, so don't worry. {% endhint %} If you entered the TLS certificates, you'll go directly to the Labels when you eventually click **create Listener**. {% endstep %} {% step %} The TLS credentials are saved in Onum as Secrets. In the TLS form, click **New secret** to create a new one: * Give the secret a **Name**. * Turn off the **Expiration date** option. * Click **Add new value.** * Click **Save**. {% hint style="info" %} Learn more about secrets in Onum in [this article](/settings/organization-settings/secrets-management.md). {% endhint %} You can now select the secret you just created in the corresponding fields. {% endstep %} {% step %} Finally, click **Create labels**. Optionally, you can set labels to be used for internal Onum routing of data. By default, data will be set as **Unlabeled**. {% hint style="info" %} Learn more about labels in [this article](/listeners/labels.md). {% endhint %} {% endstep %} {% endstepper %} Click **Create listener** when you're done. ## NXLogs setup Once you have downloaded NXLog Community Edition or Enterprise Edition from the [NXLog website](https://nxlog.co/products/nxlog-community-edition/download), run the installer with administrative privileges and complete the installation using the default options. ### Configure NXLog to Forward to Onum 1. Navigate to the NXLog configuration directory: * Typically `C:\Program Files\nxlog\conf\` 2. Create a backup of the existing configuration: * Copy `nxlog.conf` to `nxlog.conf.bak` 3. Edit `nxlog.conf` with a text editor (run as administrator) 4. Replace the contents with the following configuration, adjusting as needed: ``` define ROOT C:\Program Files\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log Panic Soft #NoFreeOnExit TRUE Module xm_json Module xm_syslog Module im_msvistalog # Collect from these Windows Event channels Channel Application, System, Security # Uncomment for additional channels as needed # Channel Microsoft-Windows-Sysmon/Operational Module pm_transformer # Convert Windows events to Syslog format Exec $SourceName = $Channel; Exec $Message = to_json(); Exec $SyslogFacilityValue = 16; Exec $SyslogSeverityValue = 6; Exec $hostname = hostname_fqdn(); Module om_tcp # Change to om_udp if using UDP in Onum Host YOUR_ONUM_LISTENER_ADDRESS # Replace with your Onum listener address Port 514 # Match the port configured in Onum OutputType Syslog_RFC5424 # For TLS configuration (if enabled in Onum) # SSL_CAFile %CERTDIR%\ca.pem # SSL_CertFile %CERTDIR%\client-cert.pem # SSL_CertKeyFile %CERTDIR%\client-key.pem # SSL_AllowUntrusted TRUE Path windows_events => transform_to_syslog => onum_syslog ``` 5. Replace `YOUR_ONUM_LISTENER_ADDRESS` with your Onum Syslog Listener address 6. Ensure the `Port` matches what you configured in Onum 7. If using UDP instead of TCP, change `om_tcp` to `om_udp` 8. If using TLS, uncomment and configure the SSL parameters.