Quick References¶

Service Commands¶

# Start the agent
Start-Service lpagentstandalone

# Stop the agent
Stop-Service lpagentstandalone

# Restart the agent
Restart-Service lpagentstandalone

# Check status
Get-Service lpagentstandalone

File Locations¶

Item	Path
Installation Directory	`C:\Program Files\lpagentstandalone\`
Configuration File	`C:\Program Files\lpagentstandalone\conf\lpagentstandalone.conf`
Configuration Directory	`C:\Program Files\lpagentstandalone\conf\lpagentstandalone.d\`
Agent Logs	`C:\Program Files\lpagentstandalone\data\lpagentstandalone.log`
Certificate Directory	`C:\Program Files\lpagentstandalone\cert\`
DHCP Logs (Source)	`C:\Windows\System32\dhcp\DhcpSrvLog-*.log`
DNS Logs (Source)	`C:\Windows\System32\dns\dns*.log`

Network Requirements¶

Protocol: UDP (default) or TCP
Port: 514 (configurable)
Direction: Agent → Logpoint SIEM
Firewall: Ensure port 514 UDP is open

Configuration Templates¶

Simple Configuration¶

Windows Event Logs only
Minimal filtering
UDP output
Basic agent logging

Advanced Configuration¶

Windows Event Logs with filtering
DHCP log collection
DNS debug log collection
Registry monitoring with FIM
Comprehensive exclusions
Enhanced log rotation

Data Verification Searches¶

# Windows Events
ModuleType="event_log" earliest=-15m

# Registry Changes
ModuleType="registry_scanner" earliest=-15m

# DHCP Events
SourceName="DHCPEvents" earliest=-15m

# DNS Events
SourceName="DNSDebug" earliest=-15m

Key Configuration Parameters¶

Parameter	Values	Purpose
LogLevel	INFO, DEBUG, WARNING, ERROR	Controls verbosity of agent logs
ResolveSID	TRUE, FALSE	Whether to resolve Security IDs to names
ReadFromLast	TRUE, FALSE	Start from last position or beginning
SavePos	TRUE, FALSE	Remember file read position
Recursive	TRUE, FALSE	Enable recursive registry scanning
64BitView	TRUE, FALSE	Use 64-bit registry view
ScanInterval	Seconds	Time between registry scans

Additional Resources¶

NXLog Documentation¶

For more detailed information on configuration options and advanced features, refer to the NXLog documentation.

Common Configuration Patterns¶

Collecting a single specific Event ID:

<Select Path="Security">*[System[(EventID=4624)]]</Select>

Multiple specific Event IDs:

<Select Path="Security">*[System[(EventID=4624 or EventID=4625)]]</Select>

Dropping specific Event IDs:

Exec if $EventID in (4663, 5156) drop();

Helpful?