> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-configure-an-enginsight-siem-extractor-for-nginx.md).

# How do I configure an Enginsight SIEM extractor for nginx?

By default, nginx writes its logs to local file directories. However, for Enginsight to collect and process these logs, they must be forwarded via syslog.

In this article, we show you how to configure nginx so that logs are provided in the correct format and can be processed by the Enginsight SIEM.

You can then [create a suitable Syslog Collector](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays/add-event-relay) in the Enginsight platform under **SIEM** → **General Collectors** → [Event Relays](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays).

***

{% stepper %}
{% step %}

### Open the nginx configuration file

Open the nginx configuration file using the following command:

```
sudo nano /etc/nginx/nginx.conf
```

{% endstep %}

{% step %}

### Adjust the configuration file

Navigate to the `http` section and adjust the configuration file as follows:

<pre><code>http {
  ...
  	##
	# Syslog
	##

<strong>	log_format ngs '$remote_addr - $remote_user "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" ["$server_name" $server_port $remote_port "$upstream_addr"]';
</strong><strong>	access_log syslog:server=&#x3C;RelayServerIPAddress>:&#x3C;RelayServerPort> ngs;
</strong><strong>	error_log syslog:server=&#x3C;RelayServerIPAddress>:&#x3C;RelayServerPort> &#x3C;LogLevel>;
</strong>  ...
}
</code></pre>

Replace the parameters in `<>` as follows:

<table><thead><tr><th width="235.359375">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;RelayServerIPAddress></code></td><td><p>The IP address of the relay server.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The relay server is the host on which the Syslog Collector for the Enginsight SIEM is to be set up.</p></div></td></tr><tr><td><code>&#x3C;RelayServerPort></code></td><td>The port on which the relay server accepts syslog messages.</td></tr><tr><td><code>&#x3C;LogLevel></code></td><td><p>The severity of the log entries you want to capture.</p><p>The following severities are available:</p><ul><li><code>info</code></li><li><code>notice</code></li><li><code>warn</code></li><li><code>error</code></li><li><code>crit</code></li><li><code>alert</code></li><li><code>emerg</code></li></ul></td></tr></tbody></table>
{% endstep %}

{% step %}

### Save the changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Ensure syslog format RFC 3164

The syslog messages must be sent in **RFC 3164** format so that the relay server can process the logs correctly.

Therefore, verify that nginx generates syslog output in this format. This is usually the case in the default nginx configuration.
{% endstep %}

{% step %}

### Check the time zone

Display the current date, including the time zone, using the following command to ensure that the system time and time zone are set correctly:

```
date
```

The displayed time zone should match the server region to ensure correct timestamps in the logs.
{% endstep %}

{% step %}

### Check the nginx configuration

Run the following command to ensure that the configuration is valid:

```
sudo nginx -t
```

{% hint style="warning" %}
**Please note**: Not all log parameters are always available.
{% endhint %}
{% endstep %}

{% step %}

### Apply the changes to the nginx configuration

Reload the updated nginx configuration using the following command:

```
sudo service nginx reload
```

{% endstep %}

{% step %}

### Create a Syslog Collector

You can now create a suitable Syslog Collector in the Enginsight SIEM.

1. Log in to the Enginsight Platform.
2. Navigate to **SIEM** → **General Collectors** → **Event Relay**.
3. Click **Add Collector Relais** in the upper-right corner of the view to add a new collector.
4. Make sure that, in the **Host** field, you select the host that acts as the relay server.
5. Make sure that, in the **Format** field, you select the correct syslog format **RFC3164**.
6. Make sure that, in the [Predefined Extractors](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays/add-event-relay#predefined-extractors) section, you select the extractor **F5 Networks** → **Nginx**.
   {% endstep %}
   {% endstepper %}

***