Skip to content

Instantly share code, notes, and snippets.

@idefux

idefux/nxlog.conf

Created June 25, 2015 07:18
Download ZIP

Revisions

  1. idefux created this gist Jun 25, 2015.
    42 changes: 42 additions & 0 deletions nxlog.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,42 @@
    # This is not a full nxlog.conf file!
    # Paste this to your nxlog.conf
    # Will regularly read the WinCC Log and extract user/auth info

    <Extension csvWinCCLog>
    Module xm_csv
    Fields $id, $date, $time, $command, $x2, $user, $host, $x3, $x4, $x5, $x6, $x7, $x8, $x9, $x10, $x11
    FieldTypes integer, string, string, integer, integer, string, string, string, string, string, string, string, string, string, string, string
    Delimiter ,
    </Extension>

    <Input in_file_WinCC_OpLog>
    Module im_file
    File 'C:\Program Files\Siemens\WinCC\diagnose\WinCC_Op_*.log'
    SavePos TRUE
    ReadFromLast TRUE
    PollInterval 30
    Exec if $raw_event == '' drop();

    Exec csvWinCCLog->parse_csv(); \
    if $user == 'Standard' drop(); \
    $SourceName = 'WinCC Runtime'; \
    $Hostname = hostname(); \
    $Severity = 'Notice'; \
    $MessageSourceAddress = hostname(); \
    $SyslogFacilityValue = 4; \
    if $command == 1008003 $Message = 'User: ' + $user + ' logged in.'; \
    if $command == 1008005 $Message = 'User: ' + $user + ' logged out.'; \
    if $date =~ /(\d{2})\.(\d{2})\.(\d{4})/ \
    { \
    $EventTime = parsedate($3 + '-' + $2 + '-' + $1 + ' ' + substr($time, 0, 8)); \
    } \
    else \
    { \
    $EventTime = now(); \
    } \
    to_syslog_bsd();
    </Input>

    <Route WinCCLog>
    Path in_file_WinCC_OpLog => out_udp_514
    </Route>