NXLog installation and configuration

The following instructions contain sample entries. Trellix encourages you to read the full documentation.

To install and configure NXLog:

Obtain the latest MSI install file from http://sourceforge.net/projects/nxlog-ce/files/.
Run the NXLog installer using the MSI package, accept the license agreement, and click finish.
Set the NXLog service to start automatically.
Stop the NXLog service using the Windows service control manager.
Use a text editor to open the nxlog configuration file located in one of the following directories:
- C:\Program Files\nxlog\conf
- C:\Program Files (x86)\nxlog\conf (on 64-bit architectures)
Note
This is the “ROOT” directory referenced in configuration files.
Confirm the NXLOG install directory and system architecture (32-bit or 64-bit).
Rename or delete the existing nxlog.conf file from the ROOT directory so it will not be used.
Copy the correct Trellix Helix NXLOG configuration for your operating system (64 bit or 32 bit) to the conf directory under the main NXLOG install directory and replace the existing nxlog.conf file (default configuration created at installation).
- nxlog.conf File for x64 (64-bit) Architecture
- nxlog.conf File for x86 (32-bit) Architecure
Restart the nxlog service to get the changes in your nxlog.conf file:
```
net stop nxlog net start nxlog
```
Configure the IP address of the Trellix Helix Sender in the configuration by replacing "X.X.X.X" with the actual IPv4 address:
```
## Specify the TAP Sender IP address to send logs to by replacing X.X.X.X define TAP_Sender_IP X.X.X.X
```
If instructed to do so, or if the Trellix Helix Sender configuration was customized, modify the service port of the Trellix Helix Sender "tagged JSON port" in the configuration by replacing "515" with the correct port number (default is 515):
```
## If instructed, specify alternate TAP Sender Port to send logs to define TAP_Sender_Port 515
```
Start the NXLOG service using the Windows service control manager.