twwinlog

Windows event log sensor for TWSNMP FC

English | 日本語

About twwinlog

twwinlog is a lightweight and efficient Windows Event Log collector and forwarder written in Go. It is designed to monitor Windows system, security, and application logs in real-time and forward them to external syslog servers or TWSNMP FC.

Unlike heavy agents, twwinlog focuses on simplicity and performance, making it ideal for both small-scale monitoring and enterprise environments where low resource overhead is critical.

Key Features

• 🚀 High Performance: Built with Go for minimal CPU and memory footprint.
• 🔍 Powerful Filtering: Support for regular expression-based filtering to send only the logs you actually need.
• 📡 Flexible Forwarding: Supports standard Syslog (UDP/TCP) and optimized integration with TWSNMP FC.
• 🛠 Easy Deployment: Single binary execution with a simple YAML configuration.
• 🛡 Secure & Reliable: Stable event tracking using Windows Event Log API.

Collectible Information

You can get the following information in the current version:

• Aggregation of the number of events
• Aggregation by event ID
• Logon information (4624, 4625, 4648, 4634, 4647)
• Account change information (4720, 4722, 4723, 4724, 4726, 4738, 4740, 4767, 4781)
• Privileged access information (4672, 4673)
• Kerberos authentication information (4768, 4769)
• Scheduled task information (4698)
• Process start and stop information (4688, 4689)
• Logon failure notifications (4625)
• Kerberos ticket request failure notifications (4768, 4769)
• Event log clearing notifications (1102)

Status

The trial version V1.0.0 has been released.(2021/8/8) Log transmission improvement version V1.1.0 has been released.(2021/8/21) V1.1.2 has been released.(2025/1/26) V2.0.0 has been released.(2026/3/25)

• Added MQTT data transmission support and structured event logging.
• Modified Syslog transmission to be non-blocking for better robustness.
• Enhanced documentation with an infographic and English/Japanese separation.
• Enabled GitHub Pages integration.

Build

do make to build

$make

You can specify the following targets.

  all        Build executable files (omitted)
  clean      Delete the builded executable file
  zip        Create Zip files for release

$make

Execute the executable file for Windows in the dist directory.

To create a zip file for distribution,

$make zip

Is executed.The zip file is created in the dist/ directory.

Run

Usage

Usage of twwinlog.exe:
  -auth string
        remote authentication:Default|Negotiate|Kerberos|NTLM
  -cpuprofile file
        write cpu profile to file
  -debug
        Debug Mode
  -interval int
        syslog send interval(sec) (default 300)
  -memprofile file
        write memory profile to file
  -mqtt string
        mqtt broker destination
  -mqttClientID string
        mqtt client id (default "twwinlog")
  -mqttPassword string
        mqtt password
  -mqttTopic string
        mqtt topic (default "twwinlog")
  -mqttUser string
        mqtt user name
  -password string
        remote user's password
  -remote string
        remote windows pc
  -syslog string
        syslog destination list
  -user string
        remote user name

Parameters	Contents
Syslog	Syslog destination
Mqtt	MQTT broker destination
MqttClientID	MQTT client id
MqttUser/Password	MQTT user name and password
MqttTopic	MQTT topic
Interval	Check interval (sec)
Auth	Remote PC authentication method
User/Password	User name and password for authentication of remote PC
Remote	Remote PC
Debug	Debug Mode

Syslog destinations can be specified multiple by separation of comma. : You can also specify the port number.

-syslog 192.168.1.1,192.168.1.2:5514

Start method

To start, you need to specify a Syslog destination(-syslog) or MQTT broker(-mqtt).

You can send to syslog with the following command.

>twwinlog.exe  -syslog 192.168.1.1

To send to MQTT broker, start with the following command.

>twwinlog.exe -mqtt 192.168.1.1

To monitor remote PC event log

>twwinlog.exe  -syslog 192.168.1.1 -remote <PC Address> -user <User> -password <Password>

syslog message examle

The sentence of the transmitted syslog message is local5.TAG is TwwinLog.

This is an example of a log of the tallying by event ID.

type=EventID,computer=YMIRYZ,channel=System,provider=Microsoft-Windows-Dhcp-Client,eventID=50103,total=1,count=1,ft=2025-01-23T17:19:19+09:00,lt=2025-01-23T17:19:19+09:00

TWSNMP FC Package

The TWWINLOG is included in the TWSNMP FC package. Only Windows version.

For more information https://note.com/twsnmp/n/nc6e49c284afb Please see

Copyright

see ./LICENSE

Copyright 2021-2026 Masayuki Yamai