WindowsのEventLogをUbuntuサーバーへ転送して、可視化等の処理を行う手順。
Windowsへnxlogをインストールし、環境に合わせてnxlog.confを編集する。
nxlogのconfig例（json形式で 514/TCPでsyslogとして転送)
参考にした情報：NXLogでWindowsイベントログをsyslog転送してみた
# NXLog Community Edition configuration file
#
# For more information see "C:\Program Files (x86)\nxlog\conf\nxlog.conf"
# or latest version online at https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html
# If you experience problems, see https://nxlog.co/community-forum
#### DEFINE ####
define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %LOGFILE%
#### EXTENSION ####
<Extension exec>
Module xm_exec
</Extension>
<Extension json>
Module xm_json
</Extension>
<Extension syslog>
Module xm_syslog
</Extension>
<Extension charconv>
Module xm_charconv
AutodetectCharsets shift_jis, utf-8
</Extension>
<Extension fileop>
Module xm_fileop
<Schedule>
Every 1 week
<Exec>
file_cycle('%LOGFILE%', 4);
</Exec>
</Schedule>
</Extension>
#### INPUT SECTION ####
<Input input_application>
Module im_msvistalog
Query <QueryList><Query Id="0"><Select Path="Application">*</Select></Query></QueryList>
<Exec>
$Message = to_json();
$Hostname = hostname();
</Exec>
</Input>
<Input input_security>
Module im_msvistalog
Query <QueryList><Query Id="0"><Select Path="Security">*</Select></Query></QueryList>
<Exec>
$Message = to_json();
$Hostname = hostname();
</Exec>
</Input>
<Input input_system>
Module im_msvistalog
Query <QueryList><Query Id="0"><Select Path="System">*</Select></Query></QueryList>
<Exec>
$Message = to_json();
$Hostname = hostname();
</Exec>
</Input>
#### PROCESSOR SECTION ####
<Processor buffer_memory>
Module pm_buffer
Type Mem
MaxSize 128000
WarnLimit 16000
</Processor>
#### OUTPUT SECTION ####
<Output output_syslog>
Module om_tcp
Host 192.168.68.73
Port 514
<Exec>
$SourceName = 'NXLog';
$SyslogFacility = 'local0';
$SyslogSeverityValue = '6';
to_syslog_ietf();
</Exec>
</Output>
#### ROUTE SECTION ####
<Route route_application>
path input_application => buffer_memory => output_syslog
</Route>
<Route route_security>
path input_security => buffer_memory => output_syslog
</Route>
<Route route_system>
path input_system => buffer_memory => output_syslog
</Route>
EventIDでフィルタリングする例
define AccountUsage 4740, 4648, 4781, 4733, 1518, 4776, 5376, 5377, \
4767, 4728, 4732, 4756, 4704, 4672, 4624
｛ 中略 ｝
#### INPUT SECTION ####
<Input eventlog>
Module im_msvistalog
<QueryXML>
<QueryList>
<Query Id='0'>
<Select Path='Security'>*</Select>
</Query>
</QueryList>
</QueryXML>
<Exec>
if ($EventID NOT IN (%AccountUsage%)) drop();
$Message = to_json();
$Hostname = hostname();
</Exec>
</Input>Ubuntug側で514/TCPを受信し、WindowsPC(192.168.68.52)から受信した情報に名前（win.log)を付して保存するように設定(rsyslog.conf)
module(load=”imtcp”)
input(type=”imtcp” port=”514″)
:fromhost-ip, isequal, “192.168.68.52” /var/log/win.log
pythonでjson形式のWindows EventLogを一時処理
cat /var/log/syslog | grep -a EventTime の出力を、次のスクリプトでテキスト化
mport sys
import json
import traceback
n=0
for line in sys.stdin:
n=line.find('{"E') # 文字列 {"Eの位置を得る
tmp=line[n:]
m=tmp.find('#') # {"E から # の部分文字列がEventLogの本体
tmp=tmp[0:m]
try:
di = json.loads(tmp)
n=n+1
for k, v in di.items():
print(f'{k}:{v}')
except: # エラー情報の表示（デバッグ用）
t = traceback.format_exc()
print(t)
if tmp!='':
print('-----------------')
print(tmp)
print('-----------------')
print('Total lines:',n)PHPのスクリプト例
<?php
while($line= fgets(STDIN)){
$p=strpos($line,'{"E');
$tmp=substr($line,$p);
$p=strpos($tmp,'#');
$json=substr($tmp,0,$p);
#echo "$json\n";
$lines=json_decode($json);
foreach ($lines as $key => $var){
echo "$key,$var\n";
}
}
?>イベントIDを指定
<Input eventlog>
# Uncomment im_msvistalog for Windows Vista/2008 and later
Module im_msvistalog
Query <QueryList>¥
<Query Id=”0″>¥
<Select Path=’Security’>*[System[(EventID=’4663′) ]]</Select>¥
<Select Path=’Security’>*[System[(EventID=’4656′) ]]</Select>¥
<Select Path=’Security’>*[System[(EventID=’4658′) ]]</Select>¥
</Query>¥
</QueryList>
# Uncomment im_mseventlog for Windows XP/2000/2003
# Module im_mseventlog
</Input>