NXLog search
Let's talk Start free
Let's talk Start free
6.05

Microsoft Windows

This page describes the steps for installing and upgrading NXLog Agent on Microsoft Windows.

Installing NXLog Agent

First, download the NXLog Agent MSI file from the NXLog website.

  1. Log in to your account, then click My account at the top of the page.

  2. Under the Downloads > NXLog Agent files tab, choose the correct package for your system.

    Table 1. Available NXLog Agent Windows installers
    Platform Package

    Microsoft Windows, 64-bit

    nxlog-6.5.9781_windows_x64.msi
    The NXLog Agent installer packages are digitally signed. See Verify the signature of the Windows installer for further details.

Connecting to NXLog Platform

You can configure NXLog Agent to connect to NXLog Platform automatically. The installation looks for the following command line arguments to configure the Remote Management (xm_admin) instance in the managed.conf file.

NXP_ADDRESS

The NXLog Platform Agent Management URL and port. The installation sets the Host to this value.

NXP_AGENT_LABEL

Sets the agent_label label to this value. You can use this label to Set up automatic agent enrollment.

For example:

> msiexec /q /i nxlog-6.5.9781_windows_x64.msi NXP_ADDRESS="agents.example.com:5515" NXP_AGENT_LABEL="new"

Installing interactively

  1. Run the installer by double-clicking the MSI file. Accept the license agreement and choose and, optionally, choose an alternative installation directory. Click Install to start the installation.

  2. Once the installation is ready, click Finish. This will open the README.txt file in Notepad.

  3. Configure NXLog Agent by editing nxlog.conf. You can find the file at C:\Program Files\nxlog\conf\nxlog.conf by default.
    See Log collection in the NXLog Platform User Guide for more information and configuration examples.
    For more details about configuring NXLog Agent to collect logs on Windows, see Microsoft Windows log sources.

  4. Verify the configuration file syntax.

    > "C:\Program Files\nxlog\nxlog.exe" -v
2017-03-17 08:05:06 INFO configuration OK

  5. Start NXLog Agent from the Service console (services.msc). The service name is nxlog. You can also run NXLog Agent from the command line by invoking nxlog.exe with the -f argument.

  6. Open the NXLog Agent log file, by default, C:\Program Files\nxlog\data\nxlog.log, with a text editor to check for errors.

    Some text editors such as Wordpad use exclusive locking and will refuse to open the log file while NXLog Agent is running.

Installing with msiexec

You can use msiexec for an unattended installation. This command shows no prompts, but you must run it with administrator privileges.

> msiexec /i nxlog-6.5.9781_windows_x64.msi /q

To allow Windows to prompt for administrator privileges but still execute an unattended installation, use /qb instead.

> msiexec /i nxlog-6.5.9781_windows_x64.msi /qb

To specify a custom installation directory, use the INSTALLDIR property.

> msiexec /i nxlog-6.5.9781_windows_x64.msi /q INSTALLDIR="C:\nxlog"

Installing via Group Policy

For large deployments, it may be convenient to use Group Policy to install NXLog Agent.

These steps were tested with a Windows Server 2016 domain controller and a Windows 7 client. There are multiple ways to configure an NXLog Agent installation with Group Policy. The required steps for your network may vary from those listed below.

  1. Log on to the server as an administrator.

  2. Set up an Active Directory group for computers requiring an NXLog Agent installation. NXLog Agent will be automatically installed and configured on each computer in this group.

    1. Open the Active Directory Users and Groups console (dsa.msc).

    2. Under the domain, right-click on Computers and click Group.

    3. Provide a name for the group. For example, nxlog. Use the Security group type and Global context (or the context suitable for your case).

    4. Add computers to the group by selecting one or more, clicking Add to a group…, and entering the group name (nxlog).

  3. Create a network share for distributing the NXLog Agent files.

    1. Create a folder in the desired location (for example, C:\nxlog-dist).

    2. Set up the folder as a share: right-click, select Properties, open the Sharing tab, and click Share….

    3. Add the group (nxlog) and click Share. Take note of the share name provided by the wizard, it will be needed later (for example, \\WINSERV1\nxlog-dist).

    4. Copy the required files to the shared folder. If you manage your agents from NXLog Platform, this will include at least three files: nxlog-6.5.9781_windows_x64.msi, managed.conf, and the CA certificate agent-ca.pem. If not, use a custom nxlog.conf instead of managed.conf, omit the CA certificate, and include any other files required by the configuration.

      The managed.conf file is located in the C:\Program Files\nxlog\conf\nxlog.d\ directory.

  4. Create a Group Policy Object (GPO) for the NXLog Agent deployment.

    1. Open the Group Policy Management console (gpmc.msc).

    2. In the console tree, under Domains, right-click on your domain and click Create a GPO in this domain, and Link it here…; this will create a GPO under the Group Policy Objects folder and link it to the domain.

    3. Name the GPO (for example, nxlog) and click OK.

    4. Select the newly created GPO in the tree.

    5. In the Security Filtering list, add the Active Directory group created in step 2 (nxlog). Remove anything else.

    6. Right-click on the GPO and click Edit. The Group Policy Management Editor console will be opened for editing the GPO.

  5. Add the NXLog Agent MSI to the GPO.

    Group Policy Management Editor
    Figure 1. Configured NXLog Agent GPO

    1. Under Computer Configuration > Policies > Software Settings, right-click Software installation. Click New > Package… to create a deployment package for NXLog Agent.

    2. Browse to the network share and open the nxlog-6.5.9781_windows_x64.msi package. It is important to use the Uniform Naming Convention (UNC) path (for example, \\WINSERV1\nxlog-dist) so the file will be accessible by remote computers.

    3. Select the Assigned deployment method.

  6. Add the required files to the GPO by following these steps for each file.

    1. Under Computer Configuration > Preferences > Windows Settings, right-click on Files. Click New > File.

    2. Select the Replace action in the drop-down.

    3. Choose the source file on the network share (for example, \\WINSERV1\nxlog-dist\managed.conf or \\WINSERV1\nxlog-dist\agent-ca.pem).

    4. Type in the destination path for the file (for example, C:\Program Files\nxlog\conf\nxlog.d\managed.conf or C:\Program Files\nxlog\cert\agent-ca.pem).

    5. Check Apply once and do not reapply under the Common tab for files that should only be deployed once. This is especially important for managed.conf because NXLog Platform will write configuration changes to that file.

    6. Click OK to create the File in the GPO.

  7. After the Group Policy is updated on the clients and NXLog Agent is installed, one more reboot will be required before the NXLog Agent service starts automatically.

For more information about Group Policy, see the following Microsoft Learn articles:

Prevent the service from starting automatically during installation

The default behavior of the NXLog Agent MSI installer is to automatically start the service during the installation process. In environments where this behavior is undesirable, the MSI installer can be edited to prevent the NXLog Agent service from starting automatically.

InstEd is a free tool for editing MSI packages. Follow the steps below to use this tool and disable automatic service start for the NXLog Agent MSI installer. These steps have been tested with InstEd version 1.5.15.26.

InstEd is a third-party software and using it subjects you to its terms and conditions. NXLog provides no guarantees and is not responsible for any loss or damage of any sort resulting from the use of third-party products.

  1. Download and install InstEd MSI editor.

  2. Open InstEd, click on File > Open, and select the desired NXLog Agent MSI package.

  3. With the Tables tab selected, scroll down to locate ServiceControl.

  4. Change the Event column to 0x0004 and the Wait column to 0.

  5. Click on File > Save and specify a name for the new package.

  6. Close InstEd and install NXLog Agent.

    InstEd Editor configuration

    InstEd Editor

    You must close InstEd before installing NXLog Agent.

Upgrading NXLog Agent

Follow these steps to upgrade NXLog Agent to the latest release, or to replace a trial installation with a licensed copy. The installation will not modify the existing configuration files unless you specify the FORCE command line argument. However, we recommend backing up the configuration files before starting this process.

When upgrading, you can configure new NXLog Platform settings by specifying the relevant command line arguments in addition to the FORCE argument when executing the installer. For example:

> msiexec /q /i nxlog-6.5.9781_windows_x64.msi NXP_ADDRESS="agents.example.com:5515" NXP_AGENT_LABEL="windows" FORCE="TRUE"

When forcing a configuration update, the installation backs up the nxlog.conf and managed.conf files before applying the changes.

Currently, if you specify the NXP_ADDRESS and NXP_AGENT_LABEL command line arguments without FORCE, the installer does not perform the upgrade and exits without an error message.

To upgrade interactively:

  1. Run the new MSI installer as described in Installing NXLog Agent above. The installer will detect the current installation and perform the upgrade within the same installation directory.

    If the Services console (services.msc) is open, the installer may request the computer to be rebooted or display a permission error. Please ensure that the Services console is not open before attempting an upgrade.

  2. Start the NXLog Agent service via the Services console (services.msc) or by rebooting the system. Open the NXLog Agent log file, by default, C:\Program Files\nxlog\data\nxlog.log, with a text editor to verify NXLog Agent is working as expected.

For Group Policy deployments, follow these steps:

  1. Download the new MSI package as described in Installing NXLog Agent above.

  2. Place the new MSI in the distribution share. See Create a network share above.

  3. Add this MSI as a new package to the NXLog Agent GPO. Follow the steps under Add the NXLog Agent MSI.

  4. Right-click on the new package and click Properties. Open the Upgrades tab, click Add…, select the previous version from the list, and click OK.

If you want to downgrade to a previous version of NXLog Agent, you must manually uninstall the current version first. See Uninstalling NXLog Agent.

Uninstalling NXLog Agent

There are several ways to uninstall NXLog Agent.

  • From the Control Panel (not discussed here).

  • By using msiexec and the original NXLog Agent MSI.

  • Via the same GPO it was originally deployed with.

  • Via a downloadable batch script.

In addition to the above, we provide a method to remove any Windows Registry traces after uninstalling NXLog Agent.

Uninstalling with msiexec

Uninstall NXLog Agent using msiexec with the following command:

> msiexec /x nxlog-6.5.9781_windows_x64.msi /qb
This procedure may not remove all files that were created while configuring NXLog Agent. Likewise, any files created as a result of NXLog Agent’s operations will not be removed. You may wish to delete the installation directory, C:\Program Files\nxlog by default, once NXLog Agent is uninstalled.

Uninstalling via Group Policy

Follow these steps for Group Policy installations:

  1. Open the original Group Policy Object (GPO) used for installing NXLog Agent. See Create a Group Policy Object above.

  2. For each NXLog Agent version that has been installed, right-click the package and either:

    • click All Tasks > Remove…, and choose the Immediately uninstall removal method; or

    • click Properties, open the Deployment tab, and check Uninstall this application when it falls out of the scope of management.

      NXLog Agent will be uninstalled when the GPO is no longer applied to the computer. An additional action will be required, such as removing the selected computer(s) from the nxlog group. See Set up an Active Directory group above.

Removing traces of NXLog Agent from Windows Registry

After uninstalling NXLog Agent there might be some left-over traces in the Windows Registry. We provide a list of Windows Registry entries to be removed as a .reg file. Download the reg-entries.reg file from the NXLog public contrib repository.

Execute the following command to remove any NXLog Agent remnants from Windows Registry:

> regedit.exe /S reg-entries.reg

Uninstalling with a script

You can download the necessary files from the windows-uninstall directory in NXLog’s public contrib repository.

The script combines the steps of Uninstalling with msiexec and Removing traces of NXLog Agent from Windows Registry. It also prompts you whether to remove the installation directory.

The following files need to be located in the same directory:

  • uninstall-x64.bat - The main script.

  • reg-entries.reg - The list of Windows Registry entries to remove.

  • The exact version of the MSI installer you used to install NXLog Agent.

Use the following command to execute the script:

> uninstall-x64.bat nxlog-{agent-build}_windows_x64.msi

The README.MD file in the repository explains how the script works.

© Copyright 2024 NXLog Ltd.

PRIVACY POLICY GENERAL TERMS OF BUSINESS