Table of Contents

Preface

1. Summary of contents

2. Target audience and prerequisites

3. Products covered in this guide

4. Typographical conventions

5. Contact and support information

5.1. Sales contact

5.2. Support contact

5.3. Training

6. About this document

6.1. Summary of changes

6.2. Feedback

1. Introduction

1.1. Supported operating systems

2. Installing the syslog-ng agent

2.1. Installing the syslog-ng Agent in standalone mode

2.2. Installing the syslog-ng Agent on the domain controller and the hosts of a domain

2.2.1. Installing the syslog-ng Agent on the domain controller and the hosts of a domain

2.3. Unattended installation

2.4. Upgrading syslog-ng Agent for Windows to the latest version

2.5. Upgrading syslog-ng Agent for Windows 2.x to 3.0.x

3. Configuring syslog-ng Agent for Windows

3.1. How to configure the syslog-ng Agent

3.1.1. Configuring a standalone syslog-ng Agent

3.1.2. Configuring the syslog-ng Agents of a domain

3.1.3. Using an XML-based configuration file

3.2. Configuring destinations

3.2.1. Configuring the destination logservers

3.2.2. Limiting the rate of messages

3.3. Configuring message sources

3.3.1. Eventlog sources

3.3.2. Managing file sources

3.3.3. Configuring global settings

3.3.4. Disabling sources and filters globally

3.4. Using SSL-encrypted connections with the syslog-ng agent

3.4.1. Enabling encrypted connections

3.4.2. Using mutual authentication with syslog-ng agent

3.4.3. Importing certificates with the Microsoft Management Console

3.5. Filtering messages

3.5.1. Filtering eventlog messages

3.5.2. Filtering file messages

3.6. Customizing the message format

3.6.1. Customizing messages using templates

3.6.2. Customizing eventlog messages

3.6.3. Customizing file messages

3.6.4. Customizing the timestamp used by the syslog-ng Agent

3.6.5. Macros available in the syslog-ng Agent

3.7. Controlling the syslog-ng Agent services

3.7.1. Command-line options

4. Troubleshooting syslog-ng Agent for Windows

4.1. Sending messages and CPU load

4.2. Creating core and memory dumps

4.3. Enabling debug logging in syslog-ng Agent

4.4. Logging domain update errors

5. Configuring the auditing policy on Windows

5.1. Turning on security logging on Windows XP

5.2. Turning on security logging for domain controllers

5.3. Turning on auditing on Windows 2003 Server

Appendix 1. BalaBit syslog-ng Premium Edition License contract

1.1. SUBJECT OF THE LICENSE CONTRACT

1.2. DEFINITIONS

1.3. WORDS AND EXPRESSIONS

1.4. LICENSE GRANTS AND RESTRICTIONS

1.5. SUBSIDIARIES

1.6. INTELLECTUAL PROPERTY RIGHTS

1.7. TRADE MARKS

1.8. NEGLIGENT INFRINGEMENT

1.9. INTELLECTUAL PROPERTY INDEMNIFICATION

1.10. LICENSE FEE

1.11. WARRANTIES

1.12. DISCLAIMER OF WARRANTIES

1.13. LIMITATION OF LIABILITY

1.14. DURATION AND TERMINATION

1.15. AMENDMENTS

1.16. WAIVER

1.17. SEVERABILITY

1.18. NOTICES

1.19. MISCELLANEOUS

Appendix 2. Creative Commons Attribution Non-commercial No Derivatives (by-nc-nd) License

Glossary

Index