IDR Account - Attempting to setup .NET logging with NLog

Hello. I’m currently a user with a different company with InsightOps. I’m trying to setup another simple logging solution with Rapid7 where I just have it ingest logs from .NET. Unfortunately the new account with IDR vs InsightOps doesn’t seem to have the same workflow of simply doing a quick add w/ token.

I’m assuming I’m missing something as it’s not an option under event sources. Perhaps I signed up for the wrong account type? The products are rather confusing to figure out which is correct. The logging looks similar in your UI, but the ability to setup seems far more complex or missing.

@jgoodwin2 you are correct the quick add option doesn’t exist in IDR as a product, however you can still acieve your desired end state by leveraging the API. See here

Step 1: Create a Logset (or fetch an existing log set) InsightOps API

Step 2: Create a Log - associate it to the Log Set key you just created InsightOps API

Step 3: From the output of step 2 you will see the log token
Or you can hit InsightOps API to return all log info

I understand I am linking InsightOps documentation, but the API is the same between IDR and Ops for Log search essentially

David

1 Like

Ok. I was able to create a log set and a token based log through this. Very helpful - thank you.

I am noticing an issue that I’ve never had before - perhaps I’m missing something. I have R7Insight.Core and R7Insight.NLog installed through NuGet. The local log target is working - however, NLog upon starting states it cannot find the Insight target.

Warn Error has been raised. Exception: NLog.NLogConfigurationException: Failed to create target type: Insight
 ---> System.ArgumentException: Target cannot be found: 'Insight'
   at NLog.Config.Factory`2.CreateInstance(String itemName)
   at NLog.Config.LoggingConfigurationParser.CreateTargetType(String targetTypeName)

NLog.Config
<target name="insightops" type="Insight" region="us2" debug="true" usessl="false" token="MY-TOKEN">

I posted this issue on the repo - in case I may get more of a response there

https://github.com/rapid7/r7insight_dotnet/issues/22

It was my fault - somehow I forgot to include the extensions section:

	<extensions>
		<add assembly="R7Insight.NLog" />
	</extensions>

Glad you solved it, I did look into this but came up empty so I thought someone else might chime in

David