search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.33k stars 1.05k forks source link

Default Windows NXLog collector references x86 path, will cause issues because default nxlog install uses native x64 path #15146

Closed drewmiranda-gl closed 11 months ago

drewmiranda-gl commented 1 year ago

One of the default, out of box log collectors available in a fresh, clean install of Graylog (testing with 5.0.5) is nxlog (windows).

This collector defines an executable path of C:\Program Files (x86)\nxlog\nxlog.exe. However, when downloading/installing NXLog, the default is the native x64 install, which uses path C:\Program Files\nxlog\nxlog.exe.

It also appears, and testing verifies this, that C:\Program Files\nxlog\nxlog.exe is not a default defined entry for collector_binaries_accesslist.

This will cause friction and frustration when attempting to use NXlog on windows with graylog.

Expected Behavior

Default, out of box collector for nxlog (windows) works with the default install path on x64 windows os without any further configuration.

Current Behavior

A lot of extra work is needed (creating a custom collector, updating the sidecar.yml config) to get nxlog x64 working with graylog.

Possible Solution

  1. Change the default 'Executable Path' for nxlog (windows) to use C:\Program Files\nxlog\nxlog.exe, or add another nxlog (windows) collector for x64 endpoint use.
  2. Add C:\Program Files\nxlog\nxlog.exe to the default collector_binaries_accesslist

Steps to Reproduce (for bugs)

  1. Download NXlog CE for Windows (x86-64)
  2. Observe default install path
  3. Add a new collector in graylog
  4. Add binary path to sidecar config yml

Context

This makes using nxlog considerably more difficult that it should be and forces the graylog admin to know the above info (which to be honest isn't very well documented). Fixing this will greatly simplify the use of nxlog as a collector.

Your Environment

Please let me know if there are any questions. Happy to discuss further.

drewmiranda-gl commented 1 year ago

After cursory searching, i don't think NXlog even provide an x86 binary anymore.

drewmiranda-gl commented 11 months ago

Fixed by https://github.com/Graylog2/collector-sidecar/issues/470