Event Log for Windows XP/2000/2003 (im_mseventlog)

This module collects Windows Event Log data on Windows XP, Windows 2000, and Windows Server 2003 using the legacy Windows Event Log API. By default, the module collects events from all available log sources listed under the registry key SYSTEM\CurrentControlSet\Services\Eventlog. To limit collection to specific sources, configure the Sources directive.

For Windows Vista, Windows Server 2008, and later, use the Event Log for Windows input module instead. The legacy API used by this module cannot resolve messages produced by sources in the newer format, and sets the $Message field to the following:

The description for EventID XXXX from source SOURCE cannot be read by im_mseventlog because this does not support the newer WIN2008/Vista EventLog API. Consider using the im_msvistalog module instead.

The module resolves Windows Event Log message strings from DLL and executable files registered by each log source. If the source program has been uninstalled, the module cannot retrieve the string and sets the $Message field to the following:

The description for EventID XXXX from source SOURCE cannot be found.

To examine the supported platforms, see the list of installation packages.

Configuration

The im_mseventlog module accepts the following directives in addition to the common module directives.

Optional directives

ReadFromLast

This boolean directive instructs the module on where to start reading events from the log source when NXLog Agent starts.

When TRUE, NXLog Agent will only read events logged after NXLog Agent started, unless SavePos is TRUE and a saved position for this log source exists in the cache file.

When FALSE, NXLog Agent will read all events from the log source, unless SavePos is TRUE and a saved position for this log source exists in the cache file.

The default is TRUE.

The following matrix shows the outcome of this directive in conjunction with the SavePos directive:

ReadFromLast SavePos Saved position Outcome

TRUE

Yes

Reads events from the saved position.

TRUE

Reads events that are logged after NXLog Agent is started.

TRUE

FALSE

Yes

Reads events that are logged after NXLog Agent is started.

TRUE

FALSE

Reads events that are logged after NXLog Agent is started.

FALSE

TRUE

Yes

Reads events from the saved position.

FALSE

TRUE

Reads all events.

FALSE

Yes

Reads all events.

FALSE

Reads all events.

If the NoCache directive is TRUE, it overrides the SavePos directive. In this case, the module behaves as if SavePos is FALSE.

SavePos

Set this directive to TRUE to save the position of the last processed event before NXLog Agent exits. On the next startup, the agent reads the saved position from the cache file and resumes from that point. Together with the ReadFromLast directive, this directive allows the agent to continue reading events from the saved position.

The default is TRUE; the position of the last read event is saved and will be read from the cache file on the next startup.

If the NoCache directive is TRUE, it overrides the SavePos directive. In this case, the module behaves as if SavePos is FALSE.

Sources

Set this directive to a comma-separated list of Windows Event Log filenames, such as Security, Application, to limit collection to specific log sources. Filenames are stored in the FileName field.

If you do not specify this directive, the module reads events from all available Windows Event Log sources defined in the registry.

Note that this directive is not equivalent to the $SourceName field found within Windows Event Log records.

UTF8

Set this directive to TRUE to convert all strings to UTF-8 encoding. This calls the convert_fields() procedure and requires a Character Set Conversion module instance.

The default is TRUE, but conversion only occurs if a Character Set Conversion module instance is available; otherwise strings remain in the local codepage.

Fields

The following fields are created by im_mseventlog.

$raw_event (type: string)

The event data in key-value pairs.

$AccountName (type: string)

The username associated with the event.

$AccountType (type: string)

The Windows security principal type. The possible values are: User, Group, Domain, Alias, Well Known Group, Deleted Account, Invalid, Unknown, and Computer.

$Category (type: string)

The event category name resolved from the $CategoryNumber field.

$CategoryNumber (type: integer)

The category number equivalent to the Category field of the event record.

$Domain (type: string)

The domain name of the user.

$EventID (type: integer)

The event ID specific to the event source.

$EventTime (type: datetime)

Equivalent to the TimeGenerated field of the event record.

$EventTimeWritten (type: datetime)

Equivalent to the TimeWritten field of the event record.

$EventType (type: string)

The severity of the event. The possible values are: ERROR, AUDIT_FAILURE, AUDIT_SUCCESS, INFO, WARNING, and UNKNOWN.

$FileName (type: string)

The source log file of the event. For example, Security or Application.

$Hostname (type: string)

The host or computer name where the event was generated.

$Message (type: string)

The event message.

$RecordNumber (type: integer)

The event record number.

$Severity (type: string)

The normalized event severity name. See $SeverityValue.

$SeverityValue (type: integer)

The normalized event severity number, mapped as follows:

Event Log Severity	Normalized Severity
0/Audit Success	2/INFO
0/Audit Failure	4/ERROR
1/Critical	5/CRITICAL
2/Error	4/ERROR
3/Warning	3/WARNING
4/Information	2/INFO
5/Verbose	1/DEBUG

Event Log Severity

Normalized Severity

0/Audit Success

2/INFO

0/Audit Failure

4/ERROR

1/Critical

5/CRITICAL

2/Error

4/ERROR

3/Warning

3/WARNING

4/Information

2/INFO

5/Verbose

1/DEBUG

$SourceName (type: string)

The subsystem or application name that produced the event.

Examples

Example 1. Basic im_mseventlog configuration

The following is a basic configuration that collects events from the Application, Security, and System logs.

nxlog.conf

<Input windows_events>
    Module     im_mseventlog
    Sources    Application, Security, System
</Input>