Publishing SCCM Logs and Events to GrayLog using NXLog

This took some digging because I wanted to have more than just the regular SCCM Logs gathered into our Centralized Logging Solution.

What goodies are added to GrayLog:

• SCEP Detection Logs
• SCCM Site Systems Server Logs
• Audit Messages Logs

SCCM Logs Prerequisites

• First we need to configure our Site’s Status Filter Rules by creating a New Rule

• Give it a name and select your Site Code

• Select Report to the Event Log as Action and finish creating the rule.

SCEP Detection Logs Prerequisites

In order to be able to send the SCEP Detection Logs to GrayLog, they must be exported using the Get-SCEPDetectionLogs script. This script must run as a Scheduled Task at regular intervals (ex. 10 minutes).

You must have the SQL Commandlets installed on the machine runs this script.

Get-SCEPDetectionLogs parameters:

• CMSQLServer = SCCM SQL Server FQDN (CMSQL.SCCM.com)
• CMDatabase = SCCM Database Name (CM_XXX)

• Set the Get-SCEPDetectionLogs to run as a Scheduled Task at a regular interval (ex. 10 minutes).

Configure NXLog

To parse Windows Event Logs, an agent needs to be installed that reads the events and transforms them in GELF or syslog format. Any agent that supports GELF can be used, but NXLog is recommended.

• Install NXLog
• Go to “C:\Program Files (x86)\nxlog\conf\nxlog.conf” and replace it with the following template:

Things To change:

61 File “CSV_File_Location\\Get-SCEPDetectionLogs.csv” — point to the file created by the Get-SCEPDetectionLogs script
75 File “D:\\CM\\Logs\\\*.log” — location of your SCCM logs to be sent
82 Host your_host_ip_or_fqdn — IP/FQDN of the graylog server you are pushing to
83 Port 12202 — the port on which Graylog is listening
89 Host your_host_ip_or_fqdn — IP/FQDN of the graylog server you are pushing to
90 Port 12202 — the port on which Graylog is listening

• Customize the NXLog config file to match your environment
• Restart your NXLog service and check C:\Program Files (x86)\nxlog\data\nxlog.log for errors.

• After the Logging Admin performs the necessary configuration on the GreyLog side, you can check your stream.
• Try filtering by SourceModuleName:SCCM, SourceModuleName:EVENTLOG or SourceModuleName:SCEP.
• If you sent SCCM Log Files from multiple systems filter by source:system_FQDN to see the logs for that machine.

If you enjoyed this piece, click the ❤ button below, share & subscribe.