What’s New in NXLog Platform 1.15 and NXLog Agent 6.16

NXLog has released NXLog Platform 1.15 and NXLog Agent 6.16, introducing improvements that make centralized log management, security investigations, and agent administration more efficient. The updates include flexible export options for log search results, better visibility into agent connectivity, simplified configuration management through the API, more reliable macOS log collection, and automatic detection of common data formats.

These enhancements help IT and security teams streamline log analysis, identify data collection issues faster, and reduce the effort required to integrate diverse telemetry sources.

Export Log Search Results for Offline Analysis and Reporting

NXLog Platform 1.15 introduces an Export option in log search, allowing analysts to download matching events for offline investigation, reporting, or collaboration with other teams.

Search results can be exported as CSV or JSON files. The export respects the active query, filters, and selected time range, ensuring that downloaded data reflects the scope of the investigation.

• CSV export: Downloads the columns currently displayed in the results table, making the data convenient to review in spreadsheet applications and use in reports.
• JSON export: Includes all available fields for each event, making it suitable for further processing by forensic, analytics, and reporting tools.

This functionality simplifies evidence sharing, supports offline analysis, and allows security teams to incorporate NXLog search results into their existing investigation workflows.

For configuration details, see the NXLog documentation on exporting log search results.

Identify Agent Connectivity Issues More Easily

Missing log data can indicate that an agent has stopped reporting or that a source has experienced a connectivity issue. NXLog Platform 1.15 makes these situations easier to investigate by adding two columns to the Agents view: Last online and Last offline.

• Last online: Shows when the agent last reported to NXLog Platform.
• Last offline: Shows when the agent last reconnected after being offline.

Both columns can be sorted and are included when exporting the agent list to CSV. Administrators can use this information to identify agents that may have stopped sending telemetry and review recent reconnection activity.

Improved visibility into agent status helps teams troubleshoot gaps in log collection and maintain more consistent monitoring across distributed environments.

Learn more in the NXLog guide to customizing the Agents view.

Upload Agent Configuration Files Directly Through the API

NXLog Platform 1.15 improves configuration management by allowing configuration files to be uploaded directly through the Agent Management API when creating or updating agent configurations.

Previously, administrators had to embed configuration content in a JSON request body and escape special characters correctly. This could make scripts more complicated and increase the risk of errors, particularly when working with large configuration files.

With direct file uploads, teams can submit configuration files as they are, making the process easier to integrate into command-line workflows, deployment scripts, and automation pipelines.

This enhancement helps standardize agent configuration management and reduces the manual effort involved in maintaining configurations across large deployments.

Improve macOS Log Collection Reliability

NXLog Agent 6.16 introduces the new macOS OSLog input module, which collects system logs through Apple's official OSLog API. The module supports macOS 10.15 Catalina and later.

Previously, macOS log collection relied on the macOS ULS input module, which reads log files in an undocumented format. Under certain conditions, particularly on busy systems, this approach could result in missed events or unnecessary error messages.

The new OSLog module uses the same API that macOS uses to provide log data, improving collection reliability and visibility into system activity. This is particularly valuable for organizations managing large macOS fleets, systems with high log volumes, or environments where frequent log rotation can complicate collection.

The existing macOS ULS module remains available, so current configurations continue to work while administrators evaluate and migrate to the new module.

For implementation details, refer to the NXLog macOS OSLog module documentation.

Automatically Detect and Parse Common Data Formats

NXLog Agent 6.16 introduces the experimental Automatic Data Parser extension module, which can detect and parse common telemetry formats, including CSV, JSON, and syslog.

Instead of manually configuring a separate parser for each data source, administrators can enable automatic parsing at the input level. This is especially useful when onboarding unfamiliar sources or collecting data from systems that produce messages in different formats.

The following example demonstrates how to configure automatic parsing for a TCP input:

<Extension autoparse>
    Module        xm_autoparse
</Extension>

<Input tcp_listen>
    Module        im_tcp
    ListenAddr    0.0.0.0:1514
    InputType     autoparse
</Input>

With this configuration, NXLog Agent attempts to identify and parse the format of incoming data automatically, helping convert raw telemetry into structured events for downstream processing and analysis.

Important: The Automatic Data Parser is experimental. Detection rules and the fields it produces may change in future releases. Test the module with representative data before using it in production environments.

For additional information, see the Automatic Data Parser documentation.

How These Updates Benefit IT and Security Teams

The latest NXLog releases address several common operational challenges in centralized log management:

• More efficient investigations: Exporting search results makes it easier to share evidence and perform offline analysis.
• Faster troubleshooting: Agent connectivity timestamps help administrators identify potential gaps in telemetry collection.
• Simplified automation: Direct configuration file uploads support scripted deployments and repeatable administration workflows.
• More reliable endpoint visibility: The new macOS OSLog module improves access to system activity logs.
• Faster data onboarding: Automatic parsing can reduce the manual effort required to structure incoming telemetry.

Together, these capabilities help organizations improve log collection, simplify day-to-day administration, and make security-relevant data easier to investigate and use.

Explore the Latest NXLog Features

For the full list of changes, enhancements, and fixes, consult the official release notes:

• NXLog Platform release notes
• NXLog Agent release notes
• NXLog Platform documentation

Softprom is an official NXLog distributor. We help organizations evaluate NXLog solutions, plan log collection architectures, and integrate log management capabilities into their IT and security environments. Contact Softprom to discuss your requirements, deployment options, or upgrade planning.