Skip to main content

Windows Active Directory Logs

NXLog Installation


Download the installation package from the NXLog website, or a copy from our AWS repository:

NXLog site:

AWS repo:


Open the installer and following the on-screen instructions to install NXLog.

After installation, a README for NXLog should appear. (It is also copied below.)


Please edit the configuration file after installation. This should be located under C:\Program Files\nxlog\conf\nxlog.conf or C:\Program Files (x86)\nxlog\conf\nxlog.conf depending on your windows architecture. You might need to adjust the ROOT folder in the config file, otherwise
nxlog will not start. After this is done, you should be able to start the nxlog service from the service manager. Alternatively, the service can be also started by executing C:\Program Files (x86)\nxlog\nxlog.exe. Running the executable with the -f command line argument will run it in foreground if you don't want to run it as a service.

nxlog will write its own messages to the logfile located under C:\Program Files (x86)\nxlog\data\nxlog.log

If you have trouble starting or running it, please take a look there.

See the NXLOG Reference Manual for details about configuration and usage. The manual should be available online at and is also installed under C:\Program Files (x86)\nxlog\doc\

Note: We can provide several .conf files (dependent on Windows Server OS version) already configured for the deployed Fluency instance. Additional editing should not be needed. It will replace the original .conf file from the installation.

The provided nxlog.conf file should be placed under:

C:\Program Files (x86)\nxlog\conf\nxlog.conf

NXLog can be started from the Services Configuration Window

Under Start Menu, choose "Administrative Tools", then select "Services" to open the Services Configuration Window:

nxlog windows services

Find and right-click the “nxlog” item, and choose the desired operation (Start/Stop/Restart).

Windows DHCP Server (skip if DHCP role is not enabled):

Enable DHCP audit logging

Under Start Menu, choose "Administrative Tools", then select "DHCP" to open the DHCP Configuration Window:

nxlog windows dhcp

Under IPv4 (right-click), select Properties:

nxlog windows ipv4

Verify that the “Enable DHCP audit logging” option is enabled. Click "OK" to confirm/exit.

Appendix A: nxlog.conf sample

# Configuration for sending Windows (AD Server) logs to Fluency Cloud
# Version: 2.0.1
# Last update: 2021-11-17


## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

# For 32-bit systems use the following:
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension json>
Module xm_json

<Extension syslog>
Module xm_syslog

<Input internal>
Module im_internal

<Input eventlog>
Module im_msvistalog
Query <QueryList>\
<Query Id="0">\
<Select Path="Application">*</Select>\
<Select Path="System">*</Select>\
<Select Path="Security">*</Select>\
Exec if ($EventID == 5156) OR ($EventID == 5158) drop();

<Input dhcp_in>
Module im_file
# For 32-bit systems use the following:
# File "C:\\Windows\\System32\\dhcp\\DhcpSrvLog-*.log"
File "C:\\Windows\\Sysnative\\dhcp\\DhcpSrvLog-*.log"
SavePos True
InputType LineBased
Exec $Message = $raw_event;

<Output fluency_out>
Exec $raw_event = replace($raw_event,"\r\n", " ");
Exec $raw_event = replace($raw_event,"\t", " ");
Exec to_json();

<Route fluency>
Path eventlog, internal => fluency_out

<Route DHCP_fluency>
Path dhcp_in => fluency_out

Appendix B: TLS Support for NXLog sample

<Output fluency_out>
Module om_ssl
Host <companyname>
Port 6514
AllowUntrusted true
CAFile %ROOT%\conf\ca.crt
Exec $raw_event = replace($raw_event,"\r\n", " ");
Exec $raw_event = replace($raw_event,"\t", " ");
Exec to_json();

Replace the "Output fluency_out" section in the default nxlog.conf file with the above text.

NOTE: An additional root certificate (ca.crt) will also be needed. This certificate file should be placed in the same directory as the nxlog.conf file on the target Windows server/machine. Please contact Fluency Support if you were not provided with this file.

Page last updated: 2023 Aug 07 16:37:10 EDT