Telemetry pipeline
Collect every log once. Send each tool only what it needs.
NXLog gathers logs, metrics and traces from IT, OT and cloud systems, removes the noise where the data is born, and routes the rest to your SIEM, observability and storage tools.
- Licensed per source, not per gigabyte
- One agent, from Windows 2000 to today
- On-premises, hybrid and air-gapped
Where it hurts today
The problems NXLog is built for
SIEM bills follow volume
Duplicate and low-value events are paid for like the ones that matter.
Collection tied to one tool
Changing or adding a SIEM means instrumenting everything again.
An agent per platform
Old servers, Unix estates and locked-down machines each need something different.
OT speaks its own languages
Industrial systems log poorly and often cannot take an agent at all.
What it does
Everything NXLog covers
- With or without an agent
- Installed where it can be, agentless for remote and cloud systems, and as a relay for syslog senders and network devices.
- One agent for every platform
- Windows, Linux, macOS, BSD, AIX and Solaris on x64, x86, ARM, PowerPC and SPARC.
- Windows in depth
- Event Log, Event Tracing, Sysmon, Event Forwarding, DNS Server, DHCP, IIS and Active Directory.
- Industrial systems
- Passive capture of Modbus, BACnet, S7, IEC 60870-5-104 and other industrial protocols.
- DNS logging
- DNS activity from Windows and Linux for spotting tunnelling and hijacking.
- Many inputs
- Files, databases, Kafka, Redis, NetFlow, SNMP, HTTP and cloud sources.
- Processing at the endpoint
- Deduplicate, filter, enrich and convert before the data leaves the machine.
- Parsing and normalising
- JSON, CSV, XML, key-value, syslog, CEF, LEEF and Grok, with your own rules.
- Personal data protection
- Mask and encrypt sensitive fields in the pipeline.
- OpenTelemetry
- Take in and send OpenTelemetry, and convert older formats into it.
- Alerts in the pipeline
- Raise an alert on an event before it reaches the SIEM.
- File integrity monitoring
- Record unauthorised changes to files and, on Windows, the registry.
- Many destinations at once
- SIEMs, observability tools, data lakes, databases and cloud storage in parallel, with failover and load balancing.
- Nothing lost
- Buffering, deferred forwarding and saving to disk while a receiver is down.
- Bandwidth control
- A ceiling on what the pipeline may use on the network.
- Central console
- Deploy and configure agents with templates, auto-enrolment and role-based access.
- Storage, search and dashboards
- A built-in compressed log store with full-text and SQL-like search.
- 120+ extensions and Solution Packs
- Ready-made modules and pipelines for common sources and destinations.
- Audit trail and retention
- Tamper-proof audit logs and retention policies for compliance evidence.
- Your own logic
- A configuration language with conditions and patterns, extended in Python, Perl, Go or Java.
How it works
From first connection to steady state
Deploy
Define the sources, install the agent, set up agentless collection where needed.
Collect and process
Parse, normalise, filter and enrich with ready-made modules.
Route
Send each destination the data and the format it needs.
Store and search
Keep the record, search it at speed, build dashboards.
Every agent is managed from the central console throughout.
Where it is used
What teams use NXLog for
Lower SIEM cost
Security events go to the SIEM; the full record goes to cheaper storage.
Compliance evidence
Policy-driven collection and retention, with personal data protected.
ICS and SCADA monitoring
Telemetry from PLCs, SCADA networks and field devices into the SOC.
OpenTelemetry for legacy systems
Mainframes and older applications become OpenTelemetry without a rewrite.
Several SIEMs, or a new one
Collection is independent of the SIEM, so switching does not start from zero.
Legacy and locked-down machines
Old operating systems and appliances where other agents cannot run.
Figures as published by NXLog.
Works with
What it connects to
Standards
Frameworks
Frameworks the pipeline helps you gather evidence for.
With Channel Nexus
Talk to someone who knows NXLog
One call, several technologies
On the booking page you choose NXLog and any other technology you want to hear about.
A consultant first, the vendor when it helps
A Channel Nexus consultant takes the call and brings in NXLog's own specialists for the detail.
A time that suits you
You pick the time. If a consultant cannot make it, we propose other times that suit you.
Datasheets
Get the NXLog datasheets
Choose up to 2 of the files, tell us who you are, and we email them to your work address.
- Brochure
- Competition - NXLog vs RSyslog, Kiwi, Solarwinds
- Competition - NXLog vs Syslog-NG
- SIEM - NXLOG x Elastic
- SIEM - NXLog x FortiSIEM
- SIEM - NXLog x Sentinel
- SIEM - NXLog x Splunk