Windows Server

Install the XPLG V7 server on Windows Server 2016 or newer: the installer, the XpoLogCenter service and its service account, memory, TLS, Windows Events and UNC collection, patches.

What you will do: install XPLG V7 (7.9859) on a Windows Server host, run it as the XpoLogCenter service under a domain account, and connect it to dock.

Choose Windows Server when XPLG must read Windows Event Logs or UNC shares directly, or when Windows is the approved platform. The X8 Compose stack is Linux-only; in a mixed estate the Windows node is usually a V7 server or a listener node that collects from Windows and forwards to the cluster. Everything that is common to every host (external configuration directory, clusters, operations) is on Virtual machine and bare metal.

Prerequisites

  • Windows Server 2016 or newer, 64-bit. See System requirements for the profile sizes.
  • Java 17 is bundled with the installer; nothing to install.
  • A domain service account that may read the remote logs you plan to collect (UNC paths, Windows network shares, Windows Events on other hosts).
  • Ports 30303 (HTTP) and 30443 (HTTPS) open from the users' network; the listener ports open from the sources; 135–139 and 445 open from XPLG to the Windows hosts it collects from agentlessly.
  • A fast local data disk; about 1.25 GB for the installation itself.

Steps

  1. Download the Windows installer (.exe) from the Download Center on www.xplg.com and copy it to the server.
  2. Run the installer as an administrator and follow the wizard: installation folder, start option. XPLG starts automatically unless you chose otherwise.
  3. In the Services panel find XpoLogCenter. On the Log On tab choose This account and enter the domain service account, then restart the service. From now on administrators can add logs over the Windows network as if they were local, with UNC paths such as \\server1\c$\logs\app.log.
  4. Open http://<host>:30303/logeye/ (HTTPS on 30443 with the self-signed certificate) and complete Configure after installation: external configuration directory, security, license, first source.
  5. Set the heap in XpoLog.lax (installation folder) on the line LAX.NL.JAVA.OPTION.ADDITIONAL: -Xmx to about 70 % of the host's RAM, at most 32 GB per process, plus -XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=D:\xplg\dumps and -Dfile.encoding=UTF-8. Restart the service.
  6. Replace the certificate with a CA-signed .pfx or .jks in ServletContainer\conf\server.xml (sslProtocol="TLSv1.2", certificateKeystoreType="PKCS12" for .pfx); set the HTTP port to 0 to serve HTTPS only.
  7. Register the deployment so it reports to your workspace under its license.

Collecting Windows data

  • Windows Events (evt / evtx) and network shares are pull sources read by a Windows node: PortX > Data > Add Data, Windows Events or Local / UNC files, with the service account's permissions. In a cluster, Windows sources must be read by a Windows node; Linux nodes cannot.
  • Fluent Bit on the source host is the push alternative: its Windows Event Log input and a tail input ship to an HTTP/S listener; see Fluent Bit.
  • Syslog from Windows appliances goes to the syslog listener like any other device.

Operations

  • Start and stop: the XpoLogCenter service; a restart is required after every lax change.
  • Logs: the product's log\ families (audit, system audit, xpologlog, collectionstat, portxstat, …) under the configuration directory; the Windows Event Log carries service start and stop.
  • Backup: the external configuration directory (XPLG keeps daily zips for 30 days under <extConf>\temp\backups\) and the data folders, copied with the service stopped.
  • Patches: download the Windows patch zip and publish it from XPLG > System > About > Publish Patch (all nodes), or run applyPatch.bat from CLI_Update.zip. Every current build requires Java 17 and Tomcat 10 (patch 9001 and later). See Upgrades and Release notes.
  • Proxy: if Teams, Office 365, PagerDuty or Slack alerts must leave through a proxy, add -Dhttps.proxyHost, -Dhttps.proxyPort and -DproxySet=true to the lax line.

Troubleshooting

  • The console does not open: check the service is running, that 30303 / 30443 are not taken and that the Windows firewall allows them.
  • Remote logs are not readable: the service still runs as Local System, or the account lacks read permission on the share; fix the Log On account and restart.
  • Out-of-memory restarts: the heap is too small for the daily volume, or above 70 % of the host; see System requirements.

More in Troubleshooting.

Next: AWS Marketplace

Source: XPLG wiki, pages 1594131986, 1594132180, 1594132078, 1594132401, 1919418369, 1708130305, 1597964372 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594131986).