SCollector Installation and Configuration

Table of Contents

• Overview
• Benefits
• Supported Inputs
• Download
• Prerequisites
• Installation and Configuration
  • Step 1: Enable SCollector on the CCE
  • Step 2: Install SCollector on the Windows host
  • Step 3: Configure collector.conf

Overview

SCollector is the ADR universal log and flow forwarder for Windows hosts. It fills two roles, and can perform both at once:

• Windows log agent. It collects Windows Event Log records from the host it is installed on. In this role it replaces NXLog, which ADR used historically for Windows logging.
• Syslog and NetFlow collector. It listens on its own ports for syslog and NetFlow sent by other devices, then forwards what it receives to the CCE. This lets a single Windows host act as a collection point for a network segment, so devices that cannot reach the CCE directly, or that should not be exposed to it, still get their logs and flows delivered.

In both roles SCollector forwards to the Collection and Control Engine (CCE) over TCP with TLS.

This article covers the prerequisites, installation, and basic configuration of SCollector. It is intended for ADR customers and support engineers.

Benefits

• Collects Windows Event Logs locally, replacing NXLog with an application built to interoperate with the ADR platform.
• Acts as a collection point for other devices, receiving syslog and NetFlow and relaying both to the CCE.
• Forwards to the CCE over a secure connection, so log data is encrypted in transit.
• Installs as a self-contained Windows service and requires no other ADR agent on the host.

Supported Inputs

Each input block in the configuration file defines one source of data. The shipped configuration defines the four below. A single installation may use any combination of them.

A file input type is also supported, for collecting from log files on disk with wildcard or regular-expression path matching. The shipped configuration contains no file input, so add one if you need it.

Every input accepts useUDP, which selects UDP instead of TCP for that listener. The shipped configuration sets useUDP => "false" on all four inputs, so all of them listen on TCP by default.

Download

Download the installer: SCollector-12.2.3.70.msi

Prerequisites

Confirm the following on the CCE before installing SCollector:

• The CCE supports TCP over TLS for secure log transmission.
• A certificate and key are in place on the CCE for TLS log forwarding.

For certificate and key creation steps, see Self Signed Certificate and Key Creation in CCE for logs forwarding with TCP over TLS.

Installation and Configuration

Step 1: Enable SCollector on the CCE

Enabling SCollector on the CCE is handled by ARIA. Contact ARIA Technical Support for assistance configuring the collector on the CCE before installing SCollector on the Windows host.

Step 2: Install SCollector on the Windows host

• Run the SCollector MSI package on the Windows host. The installer registers a Windows service named SCollector, which runs the forwarder in the background.
• If the host will receive syslog or NetFlow from other devices, allow inbound traffic to the input ports you intend to use, and point those devices at this host.

Step 3: Configure collector.conf

The installer opens collector.conf in Notepad when it finishes. You can also edit it later at C:\Program Files\Scollector\collector.conf.

Configuration Blocks

• input blocks define where data comes from, as described in Supported Inputs above.
• output blocks define a CCE destination, as a host and a port.
• route blocks connect one input to one output. Data from an input is only forwarded if a route references it.

Placeholders to Replace

Replace the following placeholders with the values for your environment:

Default Routing

The shipped configuration routes data as follows:

Example Configuration

The configuration below is based on the file shipped with SCollector 12.2.3.70. The eventid list has been expanded to 253 event IDs, covering both the SCollector default list and the event IDs collected by the NXLog configuration it replaces, so that migrating from NXLog does not reduce coverage.

# Input Configurations
# Inputs define where logs originate from

input input1 {
    # Receives log data on port 514
    port => 514
    type => syslog
    tenant_id => ""
    useUDP => "false"

}

input input2 {
    # Receives NetFlow records on port 9995
    port => 9995
    type => flow
    tenant_id => ""
    useUDP => "false"

}

input input3 {
    # Collects Windows OS logs for specified event IDs
    type => windows_os
    tenant_id => ""
    eventid => "1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17, 18, 19, 20, 21, 41, 104, 257, 258, 259, 260, 261, 262, 500, 517, 520, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539, 540, 551, 552, 565, 592, 600, 601, 602, 608, 609, 621, 622, 626, 627, 628, 629, 630, 632, 636, 642, 644, 645, 647, 663, 664, 671, 673, 675, 676, 677, 679, 680, 681, 682, 683, 684, 689, 690, 692, 1001, 1006, 1007, 1008, 1015, 1074, 1102, 1116, 1117, 1118, 1119, 1125, 2003, 2100, 4103, 4104, 4608, 4609, 4616, 4618, 4624, 4625, 4634, 4647, 4648, 4649, 4656, 4657, 4659, 4660, 4661, 4662, 4663, 4670, 4672, 4685, 4688, 4690, 4697, 4698, 4699, 4700, 4702, 4703, 4704, 4705, 4707, 4717, 4718, 4719, 4720, 4722, 4723, 4724, 4725, 4726, 4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4738, 4739, 4740, 4741, 4742, 4743, 4744, 4745, 4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4754, 4755, 4756, 4757, 4758, 4759, 4760, 4761, 4762, 4763, 4764, 4765, 4767, 4769, 4771, 4772, 4773, 4775, 4776, 4777, 4778, 4779, 4780, 4781, 4782, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4793, 4794, 4797, 4798, 4799, 4800, 4801, 4802, 4803, 4946, 4947, 4950, 4954, 4964, 4985, 5001, 5004, 5007, 5010, 5012, 5025, 5031, 5136, 5137, 5140, 5141, 5142, 5143, 5144, 5145, 5152, 5153, 5155, 5157, 5376, 5377, 5447, 5712, 6005, 6006, 6008, 7034, 7035, 7036, 7040, 7045, 8003, 8004, 8007, 23010, 23050, 23090, 34112, 34113, 64004"
    useUDP => "false"

}

input input4 {
    # Receives syslog from Windows AD and other Windows hosts on port 5154
    port => 5154
    type => syslog
    tenant_id => ""
    useUDP => "false"

}

# Output Configurations
# Outputs define destinations where logs are sent

output output1 {
    # CCE will receive on port 6514
    module => syslog
    host => CCE-IP
    port => 6514
}

output output2 {
    # CCE will receive on port 9996
    module => syslog
    host => CCE-IP
    port => 9996
}

output output3 {
    # CCE will receive on port 6554
    module => syslog
    host => CCE-IP
    port => 6554
}

output output4 {
    # CCE will receive on port 6554
    module => syslog
    host => CCE-IP
    port => 6554
}

# Route Configurations
# Routes define the mapping of input logs to output destinations

route route1 {
    input1 => output1
}

route route2 {
    input2 => output2
}

route route3 {
    input3 => output3
}

#route route4 {
#    input4 => output4
#}