Remote Management (xm_admin)

This module provides secure remote administration capabilities for NXLog Agent installations via JSON or SOAP over HTTP(S), making it easy to implement administrative scripts or create plugins for system monitoring tools such as Nagios, Munin, or Zabbix. With this module, NXLog Agent can accept or initiate connections over TCP, SSL, and Unix domain sockets.

Although the module can both initiate and accept connections, the direction of HTTP(S) requests is always the same: the module receives requests and returns an HTTP(S) response.

NXLog Platform uses this module to manage agents and requires that agent configurations contain certain elements. For more information, see NXLog Agent connectivity in the NXLog Platform User Guide.

To examine the supported platforms, see the list of installation packages.

Configuration

The xm_admin module accepts the following directives in addition to the common module directives.

Required directives

One of the following mutually exclusive directives is required for the module to start.

Host

The module connects to this IP address or hostname. If using a hostname, the module resolves the hostname to an IP address on each new connection.

You can define the port number by appending it to the IP address or hostname using a colon as a separator (host:port). The default port is 8080.

IPv6 addresses must be enclosed in square brackets ([addr]:port). For example, [2001:0db8:85a3:0:0:8a2e:0370:7334]:8080.

ListenAddr

The module listens for connections on this IP address or DNS hostname. The default is localhost.

You can define the port number by appending it to the IP address or hostname using a colon as a separator (host:port). The default port is 8080.

TLS/SSL directives

The following directives configure secure data transfer via TLS/SSL.

AllowExpired

Set this directive to TRUE to allow connections with remote hosts presenting an expired certificate. The default is FALSE; the module rejects connections with expired certificates. This directive only takes effect when RequireCert is set to TRUE.

AllowHostnameValidation

Set this directive to TRUE to require that the certificate FQDN matches the server hostname before allowing a connection. The default is FALSE; the module does not validate the remote server hostname.

AllowUntrusted

Set this directive to TRUE to allow connections with remote hosts regardless of certificate verification results. The default is FALSE; the module only accepts connections with trusted certificates.

CADir

Set this directive to the path of a directory containing Certificate Authority (CA) certificates. The module uses these certificates to verify the certificate presented by the remote host. Name the certificate files using the OpenSSL hashed format: the hash of the certificate followed by .0, .1, and so on. To find the hash of a certificate using OpenSSL:

$ openssl x509 -hash -noout -in ca.crt

For example, if the certificate hash is e2f14e4a, name the certificate file e2f14e4a.0. If there is another certificate with the same hash, name it e2f14e4a.1, and so on.

To trust a remote host’s self-signed certificate, include a copy of it in this directory.

CAFile

Set this directive to the path of the Certificate Authority (CA) certificate used to verify the certificate presented by the remote host. To trust a remote host’s self-signed certificate, specify the remote host’s certificate itself. For certificates signed by an intermediate CA, the specified certificate must contain the complete certificate chain (certificate bundle).

CAPattern

Set this directive to a PCRE2-compliant regular expression to locate a suitable Certificate Authority (CA) certificate.

This directive is supported on Windows and macOS. On Windows, the certificate must be in the Windows Certificate Store. On macOS, the certificate must be in the system keychain.

The pattern must be in the format "SUBJECT=, CN=; DN=CN=, O=, OU=, L=, ST=, C=; SAN=;". For example:

CAPattern    'DN=CN=SERVER01\.example\.com.*?SAN=DNS:SERVER01\.example\.com'

This produces the following output in the NXLog Agent log file:

matching pattern [DN=CN=SERVER01\.example\.com;.*?SAN=DNS:SERVER01\.example\.com] to certificate [SUBJECT=US, ClientState, ClientCity, ClientCompany, ClientUnit, SERVER01.example.com, CN=SERVER01.example.com; DN=CN=SERVER01.example.com, O=ClientCompany, OU=ClientUnit, L=ClientCity, ST=ClientState, C=US; SAN=DNS:SERVER01.example.com; DNS:www.SERVER01.example.com; IP:127.0.0.3; ]

If the pattern matches multiple certificates, NXLog Agent uses the first match. If the certificate changes, restart NXLog Agent to apply the new certificate.

This directive is mutually exclusive with the CAThumbprint, CADir, and CAFile directives.

On macOS, keychain behavior and certificate requirements depend on your operating system version. Newer versions enforce stricter rules on certificate algorithms and key sizes. A certificate and private key may be imported into the keychain, yet remain unusable if they do not comply with the current macOS requirements. After importing, you may also need to give NXLog Agent permission to use the certificate in the keychain.

Check your operating system documentation to find out which certificates are trusted and valid. See also Apple’s certificate requirements for macOS.

CAThumbprint

Set this directive to the thumbprint of the Certificate Authority (CA) certificate used to verify the certificate presented by the remote host.

This directive is supported on Windows and macOS. On Windows, copy the hexadecimal fingerprint string from Windows Certificate Manager (certmgr.msc). The certificate must be in a Windows certificate store accessible by NXLog Agent.

On macOS, obtain the hexadecimal fingerprint string from the Keychain Access application. The certificate must be accessible in the system keychain.

Whitespaces and colons are automatically removed.

This directive is mutually exclusive with the CADir, CAFile and CAPattern directives.

Check your operating system documentation to find out which certificates are trusted and valid. See also Apple’s certificate requirements for macOS.

CertFile

Set this directive to the path of the certificate file to present to the remote host during the TLS/SSL handshake.

CertKeyFile

Set this directive to the path of the private key file corresponding to the certificate specified by CertFile.

CertPattern

Set this directive to a PCRE2-compliant pattern to identify the certificate and its corresponding private key. The pattern must use the format "SUBJECT=, CN=, DN=, SAN=" where DN is "CN=, O=, OU=, L=, ST=, C=". This directive is supported on Windows and macOS.

On Windows, import the certificate in PFX format into the Local Computer\Personal certificate store.

On macOS, ensure the certificate and its private key are present in the System Keychain (/Library/Keychains/System.keychain).

If the pattern matches multiple certificates, NXLog Agent uses the first match. If the certificate changes, restart NXLog Agent to apply the new certificate.

This directive is mutually exclusive with the CertThumbprint, CertFile and CertKeyFile directives.

For example:

CertPattern    $hostname + 'Cert'

CertPattern    DN=CN=Client\.example\.com;.*?SAN=DNS:Client\.example\.com

This produces the following output in the NXLog Agent log file:

matching pattern [DN=CN=Client\.example\.com;.*?SAN=DNS:Client\.example\.com] to certificate [SUBJECT=US, ClientState, ClientCity, ClientCompany, ClientUnit, Client.example.com, CN=Client.example.com; DN=CN=Client.example.com, O=ClientCompany, OU=ClientUnit, L=ClientCity, ST=ClientState, C=US; SAN=DNS:Client.example.com; DNS:www.Client.example.com; IP:127.0.0.3; ]

Check your operating system documentation to find out which certificates are trusted and valid. See also Apple’s certificate requirements for macOS.

CertThumbprint

Set this directive to the thumbprint of the certificate to present to the remote server during the TLS/SSL handshake. Whitespaces and colons are automatically removed.

This directive is supported on Windows and macOS. On Windows, copy the hexadecimal fingerprint string from Windows Certificate Manager (certmgr.msc). Import the certificate to the Local Computer\Personal certificate store in PFX format. To create a PFX file from the certificate and private key using OpenSSL:

$ openssl pkcs12 -export -out server.pfx -inkey server.key -in server.pem

When the global directive UseCNGCertificates is set to FALSE, the private key must be exportable.

If you generate the certificate request using Windows Certificate Manager, enable the Make private key exportable option from the certificate properties.
If you import the certificate with the Windows Certificate Import Wizard, make sure that the Mark this key as exportable option is enabled.
If you migrate the certificate and associated private key from one Windows machine to another, select Yes, export the private key when exporting from the source machine.

When UseCNGCertificates is set to TRUE, the private key does not need to be exportable. For example, private keys stored on a TPM are always non-exportable.

On macOS, obtain the hexadecimal fingerprint string from the Keychain Access application. The certificate and its associated private key must be present in the System Keychain (/Library/Keychains/System.keychain).

For example:

CertThumbprint    7c2cc5a5fb59d4f46082a510e74df17da95e2152

This directive is mutually exclusive with the CertFile and CertKeyFile directives.

Check your operating system documentation to find out which certificates are trusted and valid. See also Apple’s certificate requirements for macOS.

CRLDir

Set this directive to the path of a directory containing certificate revocation list (CRL) files. The module uses these files to reject connections from hosts presenting a revoked certificate. Name the files using the OpenSSL hashed format: the hash of the issuer followed by .r0, .r1, and so on. To find the hash of the issuer of a CRL file using OpenSSL:

$ openssl crl -hash -noout -in crl.pem

For example, if the hash is e2f14e4a, name the file e2f14e4a.r0. If there is another file with the same hash, name it e2f14e4a.r1, and so on.

CRLFile

Set this directive to the path of the certificate revocation list (CRL) file used to reject connections from hosts presenting a revoked certificate. To generate a CRL file using OpenSSL:

$ openssl ca -gencrl -out crl.pem

DHFile

Set this directive to the path of a file containing Diffie-Hellman parameters for key exchange. Generate the parameters using dhparam(1ssl). If this directive is not set, the module uses default parameters. See the OpenSSL Wiki for further details.

KeyPass

Set this directive to the passphrase of the private key specified by CertKeyFile. This directive applies only to encrypted private keys.

To generate a private key with Triple DES encryption using OpenSSL:

$ openssl genrsa -des3 -out server.key 2048

LoadCertificateChains

Set this directive to TRUE to load the full certificate chain from the PEM file referenced by CertFile, which may contain a single certificate or the complete chain. The default is FALSE; the module loads certificates from the operating system certificate store instead.

This directive is only supported on Windows.

RequireCert

Set this directive to TRUE to require the remote host to present a certificate during the TLS/SSL handshake. The module refuses the connection if no certificate is presented. The default is TRUE.

SearchAllCertStores

Set this directive to TRUE to load all available Windows certificates into NXLog Agent for use during remote certificate verification. Any required certificates must be in a Windows certificate store accessible by NXLog Agent. This directive is only supported on Windows and is mutually exclusive with the CAThumbprint, CADir, and CAFile directives.

Sigalgs

Set this directive to the signature algorithm parameter to pass to the Windows SSL library. Accepted values depend on the available encryption providers. This directive is only supported on Windows.

SNI

Set this directive to the hostname to use for Server Name Indication (SNI).

SSLCipher

Set this directive to override the permitted cipher list for TLSv1.2 and below. Use the format described in the ciphers(1ssl) man page. For example, specify RSA:!COMPLEMENTOFALL to include all ciphers with RSA authentication but exclude ciphers without encryption.

If RSA or DSA ciphers with Diffie-Hellman key exchange are used, set DHFile to specify custom Diffie-Hellman parameters.

SSLCiphersuites

Set this directive to override the permitted cipher list for TLSv1.3. Use the same format as SSLCipher. Refer to the OpenSSL documentation for a list of valid TLS v1.3 cipher suites. The default is:

TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

SSLCompression

Set this directive to TRUE to compress data using zlib when sending over the network. The default is FALSE; the module sends data without compression.

Some Linux distributions, including Debian, provide an OpenSSL library without zlib support. The module emits a warning on startup if compression support is missing. The generic deb/rpm packages are bundled with a zlib-enabled libssl library.

SSLProtocol

Set this directive to restrict the TLS/SSL protocols the module accepts. Specify a comma-separated list of the following values: SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, and TLSv1.3. The default is TLSv1.2 and TLSv1.3. The OpenSSL library shipped by some Linux distributions does not support SSLv2 and SSLv3; these protocols will not work even if specified here.

TLSConnectLog

Set this directive to TRUE to log the TLS protocol version and cipher suite on each successful TLS/SSL handshake. This is useful for debugging, security audits, and verifying compliance with encryption standards.

TLSCertLog

Set this directive to TRUE to log the remote host’s certificate details during the TLS/SSL handshake. When available, the module logs the Subject, Issuer, NotBefore, and NotAfter fields to the NXLog Agent log file. The default is FALSE.

This directive depends on the values of the AllowUntrusted and RequireCert directives:

AllowUntrusted RequireCert Outcome

FALSE

Output depends on TLSCertLog value

FALSE

TRUE

Output depends on TLSCertLog value

TRUE

FALSE

No output regardless of TLSCertLog value

TRUE

Output depends on TLSCertLog value

UseCNGCertificates

Set this directive to TRUE to use the Windows Cryptography API: Next Generation (CNG) to access the private keys of certificates identified by a thumbprint. This directive is only supported on Windows.

Optional directives

ACL

This block directive makes a directory accessible via the GetFile and PutFile requests. These requests use the ACL name along with the filename. You can specify this directive multiple times for different directories.

AllowRead: If set to TRUE, GetFile requests are allowed on the specified directory.

AllowWrite: If set to TRUE, PutFile requests are allowed on the specified directory.

Directory: The path of the directory.

AllowIP

Set this directive to restrict incoming connections to specific IP addresses or networks. You can specify this directive multiple times to allow multiple IPs or networks. AllowIP has no effect unless ListenAddr is configured.

If AllowIP is not set, the module falls back to BlockIP to deny specific connections. If neither AllowIP nor BlockIP is set, the module does not restrict incoming connections.

The following IP address formats may be used:

0.0.0.0 (IPv4 address)
0.0.0.0/32 (IPv4 network with subnet bits)
0.0.0.0/0.0.0.0 (IPv4 network with subnet address)
aa::1 (IPv6 address)
aa::12/64 (IPv6 network with subnet bits)

BlockIP

Set this directive to deny incoming connections from specific IP addresses or networks. You can specify this directive multiple times to deny multiple IPs or networks. BlockIP has no effect unless ListenAddr is configured.

If BlockIP is not set, the module falls back to AllowIP to restrict incoming connections. If neither BlockIP nor AllowIP is set, the module does not restrict incoming connections.

The following IP address formats may be used:

0.0.0.0 (IPv4 address)
0.0.0.0/32 (IPv4 network with subnet bits)
0.0.0.0/0.0.0.0 (IPv4 network with subnet address)
aa::1 (IPv6 address)
aa::12/64 (IPv6 network with subnet bits)

MaxConnections

Set this directive to limit the number of concurrent active connections for a listening TCP socket. The default is 4294967295 (unlimited). When the limit is reached, the module rejects new connections and logs an error:

Number of allowed active connections(10) reached: 10. Refusing connection from 127.0.0.1

ConnectionIdleTimeout

Set this directive to close TCP connections that have been idle for longer than the specified number of seconds. The minimum value is 15 seconds. If this directive is not set, the module keeps idle TCP connections open indefinitely.

ExclusiveAddrUse

Set this directive to TRUE to prevent other processes or module instances from binding to the same port.

The default is FALSE; multiple module instances can bind to the same port.

This directive is only supported on Windows.

ReuseAddr

Set this directive to TRUE to allow the module instance to bind to a port that is already in use.

The default is TRUE; multiple module instances can listen on the same port and process data simultaneously.

ReusePort

Set this directive to TRUE to allow multiple module instances to listen on the same port. Each instance runs in a separate thread, allowing NXLog Agent to process incoming logs simultaneously.

The default is FALSE; multiple module instances cannot bind to the same port.

This directive is not supported on Windows.

DataTimeout

This directive sets the number of seconds that the module waits for an incoming request. If a valid request does not arrive before the timer expires, the module resets the connection. It accepts values between 5 and 3600. The default is 300 (5 minutes). Setting the value to 0 turns off the timeout mechanism.

Labels

Block directive to define custom key-value pairs to add metadata to an agent, such as the FQDN, geo-location, department, admin contact information, and so on. The module returns labels as part of the response to a ServerInfo API request.

You can set label values statically by specifying a string, a constant, or an environment variable. You can also set values by calling functions or using the include_stdout directive to execute a script. Label values are resolved only once during agent startup.

Event fields and module variables result in an Undef value since these are not available when processing labels during agent startup.

Labels should adhere to the POSIX.1-2017 standard for environment variables. Label names can only contain underscores and alphanumeric characters. The first character of a label name cannot be a digit. Symbols in label values should belong to the portable character set.

See Setting agent labels below for an example.

Reconnect

This optional directive sets the reconnect interval in seconds. If it is set, the module attempts to reconnect in every defined second. If it is not set, the reconnect interval will start at 1 second and double with every attempt. In the latter case, when the system decides that the reconnection is successful, the reconnect interval is immediately reset to 1 sec.

The Reconnect directive must be used with caution. If it is used on multiple systems, it can send reconnect requests simultaneously to the same destination, potentially overloading the destination system. It may also cause NXLog Agent to use unusually high system resources or cause NXLog Agent to become unresponsive.

ReconnectOnData

This optional directive defines the behavior when the connection with the remote host is lost. When set to TRUE, the module only attempts to reconnect when it has data to send. The default value is FALSE; it will always keep a connection open with the remote host.

NOTE: The Reconnect directive only works when used in conjunction with the Host directive.

ReversionTimeout

This directive specifies how much time, in seconds, the module should wait to acquire a connection before it reverts the managed configuration file to the previous version. It accepts values between 5 and 3600. The default is 300 (5 minutes). Setting the value to 0 turns off the reversion mechanism.

See PutFile for more information on configuration reversion.

SocketType

This directive sets the connection type. It can be one of the following:

SSL: TLS/SSL for secure network connections.

TCP: The default if SocketType is not specified.

Functions

The following functions are exported by xm_admin.

type: string get_label(type: string arg): Returns the value for the provided label. If no match is found, returns undef.
type: hash get_label(): Returns a hash with the values for all available labels. If no labels are defined, returns undef.

To use these functions you must use the module instance name. For example, for a module instance named admin1 you must use admin1->get_label().

Remote Management API

The way you request information from the API depends on whether you’re using JSON or SOAP.

JSON
SOAP

When using JSON, the HTTP POST request must include the Content-Type HTTP header with the value set to application/json. The following is an example header:

POST / HTTP/1.1
Host: 192.168.1.123:8080
Content-Type: application/json; charset=utf-8
Content-Length: nnn

Include the request details in a JSON object with the key name msg. This object should contain the following key/values:

command - A string value specifying the name of the method you’re requesting. This value is required.
params - A JSON object containing the required parameters. May be omitted for methods that do not require additional parameters.

You must send the JSON object in the body of the POST request as raw data. The following is a JSON request for ServerInfo.

{
  "msg": {
    "command": "serverInfo",
    "params": {
      "with-extensioninfo": true,
      "with-routeinfo": false
    }
  }
}

Below is an example response header to the above request.

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: nnnn

When using SOAP, the HTTP POST request must include the Content-Type HTTP header with the value set to text/xml. The following is an example header:

POST / HTTP/1.1
Host: 192.168.1.123:8080
Content-Type: text/xml; charset=utf-8
Content-Length: nnn

Add the request details to the Body element. You must send the XML data in the body of the POST request as raw data. The following is a SOAP request for ServerInfo.

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Header/>
  <SOAP-ENV:Body>
    <adm:serverInfo xmlns:adm="http://log4ensics.com/2010/AdminInterface">
        <with-extensioninfo>true</with-extensioninfo>
        <with-routeinfo>false</with-routeinfo>
    </adm:serverInfo>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Below is an example response header to the above request.

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: nnnn

Agent UUID

Each NXLog Agent installation is assigned a universally unique identifier (UUID). The agent generates the UUID the first time it starts and persists it across restarts in the agent’s data directory:

Linux: /opt/nxlog/var/spool/nxlog
Windows: C:\Program Files\nxlog\data by default

NXLog Platform uses the UUID to identify individual agents in the management interface. When NXLog Platform enrolls an agent, it sends a new UUID and a cryptographic signature via the SetUid API call. The signature binds the UUID to a specific NXLog Platform instance, confirming the agent is enrolled there. The GetUid endpoint retrieves the current UUID and, optionally, its signature.

API endpoints

The following table lists the available xm_admin API endpoints. Click on each endpoint for details.

Endpoint	Description
GetFile	Download a file from the NXLog Agent host.
GetLog	Download the NXLog Agent log file.
GetUid	Retrieve the unique identifier (UID) of the NXLog Agent installation.
ModuleInfo	Request information about a module instance.
ModuleRestart	Restart a module instance.
ModuleStart	Start a module instance.
ModuleStop	Stop a module instance.
PutFile	Upload a file to the NXLog Agent host.
RouteInfoRequest	Request information about a route.
RouteRestart	Restart a route.
RouteStart	Start a route.
RouteStop	Stop a route.
ServerInfo	Request information about NXLog Agent and its host.
ServerRestart	Restart all module instances.
ServerStart	Start all module instances.
ServerStop	Stops all input, processor, and output module instances.
SetUid	Set the NXLog Agent’s unique identifier (UID) and signature.

Endpoint

Description

GetFile

Download a file from the NXLog Agent host.

GetLog

Download the NXLog Agent log file.

GetUid

Retrieve the unique identifier (UID) of the NXLog Agent installation.

ModuleInfo

Request information about a module instance.

ModuleRestart

Restart a module instance.

ModuleStart

Start a module instance.

ModuleStop

Stop a module instance.

PutFile

Upload a file to the NXLog Agent host.

RouteInfoRequest

Request information about a route.

Restart a route.

Start a route.

Stop a route.

Request information about NXLog Agent and its host.

ServerRestart

Restart all module instances.

ServerStart

Start all module instances.

ServerStop

Stops all input, processor, and output module instances.

SetUid

Set the NXLog Agent’s unique identifier (UID) and signature.

Examples

Example 1. Basic xm_admin configuration

The following is a basic configuration that listens for connections on all available network interfaces on port 8080. This configuration is more suitable for testing and troubleshooting.

%CERTDIR% and %CONFDIR% are constants defined in the default NXLog Agent configuration.

nxlog.conf

<Extension admin>
    Module            xm_admin
    ListenAddr        0.0.0.0:8080
    SocketType        TCP
    <ACL conf>
        Directory     %CONFDIR%
        AllowRead     TRUE
        AllowWrite    TRUE
    </ACL>
    <ACL cert>
        Directory     %CERTDIR%
        AllowRead     TRUE
        AllowWrite    TRUE
    </ACL>
</Extension>

Example 2. Secure xm_admin configuration

This configuration uses TLS/SSL certificates for secure communication with the remote host.

%CERTDIR% and %CONFDIR% are constants defined in the default NXLog Agent configuration.

nxlog.conf

<Extension admin>
    Module            xm_admin
    Host              agents.nxlog.example.com:5515
    SocketType        SSL
    CAFile            %CERTDIR%/agent-ca.pem (1)
    CertFile          %CERTDIR%/agent-cert.pem (2)
    CertKeyFile       %CERTDIR%/agent-key.pem (3)
    <ACL conf>
        Directory     %CONFDIR%
        AllowRead     TRUE
        AllowWrite    TRUE
    </ACL>
    <ACL cert>
        Directory     %CERTDIR%
        AllowRead     TRUE
        AllowWrite    TRUE
    </ACL>
    <ACL logs> (4)
        Directory     /tmp/logs
        AllowRead     TRUE
        AllowWrite    TRUE
    </ACL>
</Extension>

1	The CAFile directive specifies the path of the Certificate Authority (CA) certificate.
2	The CertFile directive specifies the path of the local server’s certificate.
3	The CertKeyFile directive specifies the path of the server’s certificate private key.
4	A custom ACL named `logs` that allows GetFile and PutFile requests for the specified directory.

Example 3. Setting agent labels

This configuration sets three static labels:

os_name using a static string.
agent_base using a constant defined with the define general directive.
os using an environment variable defined with the envvar general directive.

When using define or envvar, the values must be enclosed in quotes as shown below.

It also sets labels using two other methods:

The include_stdout general directive to set labels via a script.
The hostname_fqdn() function to set the host_fqdn label.

include_stdout executes scripts during agent startup with elevated privileges. Use this feature cautiously, as it poses a security risk if the script is modified maliciously.

nxlog.conf

define BASE /opt/nxlog
envvar NXLOG_OS

<Extension admin>
   Module               xm_admin
   ...
   <labels>
      os_name           "Debian"
      agent_base        "%BASE%"
      os                "%NXLOG_OS%"

      include_stdout    /path/to/labels.sh
      host_fqdn         hostname_fqdn()
   </labels>
</Extension>

On Microsoft Windows, if the NXLog Agent service is running with a custom user account and NXLog Agent is managed from NXLog Platform, the account needs to be added to the built-in Performance Monitor Users Windows group to be able to access performance counter data. If not, the following error will be logged in the log file:

ERROR PdhAddEnglishCounterA for '\Processor(_Total)\% Processor Time' failed with error 0x800007d0: Unable to connect to the specified computer or the computer is offline.;

Furthermore, an error may be logged when NXLog Agent is configured to collect events from Windows Event Log:

ERROR xm_admin error: FormatMessage() call failed: The storage control block address is invalid.

This happens when the user account does not have permission to access the specified Windows Event Log channels. Refer to Access denied to a Windows Event Log channel in the Troubleshooting section for instructions on how to resolve this error.