Nutanix Log Integrations with Graylog and Grafana
Forwarding Nutanix cluster logs into Graylog, parsing them into normalized fields, and visualizing access activity in Grafana across a four CVM production cluster.
Nutanix Log Integrations with Graylog and Grafana
Project Description
A running integration that forwards Nutanix cluster logs into Graylog, parses them into normalized fields, and visualizes access activity in Grafana. It runs against a four CVM Nutanix cluster and covers what is actually deployed: 13 pipeline rules across 2 pipelines, one syslog input, one stream, one index set, and one Grafana dashboard.
Everything is configured in three places. Nutanix Prism defines the syslog server and the forwarded modules. Graylog 6.1.5 on Debian 12 owns the input, stream, index set, pipeline rules, and pipelines. Grafana with the OpenSearch datasource plugin reads the resulting index set and renders the operational dashboard.
The cluster runs four CVMs. Hostnames, serial numbers, usernames, and UUIDs in the shared reference logs are redacted so the integration can be published without exposing the environment. The log formats and the pipeline behaviour are exactly as deployed.
Goals & Objectives
Centralize Nutanix Telemetry
Collect API, CVM audit, and flow service activity from four cluster nodes into a centralized SOC monitoring pipeline.
Normalize Security Events
Transform heterogeneous Nutanix log formats into consistent fields that can be searched, correlated, and visualized.
Improve Security Visibility
Expose API users, endpoints, privileged activity, authentication events, configuration changes, and other security-relevant behavior.
Control Audit Noise
Filter high-volume operating system audit records before indexing while preserving events useful for security investigation.
Validate Detection Logic
Evaluate parsing and detection rules against representative telemetry to identify blind spots, false positives, and unreliable fields.
Architecture & Workflow
flowchart LR subgraph NTNX["Nutanix Cluster"] A["CVM A"] B["CVM B"] C["CVM C"] D["CVM D / Prism Leader"] end
subgraph GL["SOC Fortress / Graylog 6.1.5"]
IN["Syslog TCP Input :5141"]
STR["Nutanix Network Logs Stream"]
P1["Prism Central Parser<br/>6 Rules"]
P2["OS Audit Parser<br/>7 Rules"]
end
OS["OpenSearch<br/>nutanix_network_*"]
GR["Grafana<br/>Events Log Monitoring"]
A --> IN
B --> IN
C --> IN
D --> IN
IN --> STR
STR --> P1
STR --> P2
P1 --> OS
P2 --> OS
OS --> GR
Implementation
The integration connects Nutanix telemetry to SOC Fortress through TCP syslog. All four CVMs forward events to a centralized Graylog input on port 5141. Graylog owns the pipeline rules and pipelines that normalize each format: an Extract Fields rule for the CVM operating system audit, a Parse API Audit rule for API events, and a Parse Flow Service Logs rule for flow data. A Drop Noise rule discards six high volume kernel audit types before indexing. The normalized data lands in an OpenSearch index set, which a Grafana OpenSearch datasource reads to render the Events Log Monitoring dashboard.
The build order mattered in production: Graylog first, so the very first forwarded packet had somewhere to land and became a health signal instead of a dropped one. Then Nutanix Prism was pointed at it, the content pack was imported, both pipelines were connected to the stream, and Grafana was provisioned last.
The pipeline is tuned against live cluster traffic across all four CVMs, which surfaced parsing gaps, field pollution, timestamp differences, and coverage limitations that were then corrected in the running configuration.
Tech Stack Used
Source platform responsible for forwarding cluster and CVM telemetry through syslog.
Security monitoring environment used to centralize and analyze Nutanix activity.
Handles syslog ingestion, stream routing, filtering, parsing, normalization, and pipeline processing.
Stores the normalized Nutanix event indices produced by the Graylog pipeline.
Provides dashboards for API activity, CVM audit events, privileged execution, endpoints, and telemetry health.
Provides reliable agentless transport of telemetry from Nutanix CVMs to the centralized Graylog input.
Used within Graylog rules to extract and normalize fields from multiple Nutanix log formats.
Operating system hosting the Graylog deployment used by the integration.
Key Features & Deliverables
Agentless Nutanix Log Collection
Centralized telemetry collection from four CVMs through TCP syslog without installing additional agents on the Nutanix nodes.
13 Graylog Pipeline Rules
Implemented parsing, filtering, normalization, and security classification across Prism and CVM operating system audit telemetry.
Dual Processing Pipelines
Separated Prism-related telemetry and CVM operating system audit processing into independent multi stage Graylog pipelines.
Noise Reduction
Filtered high-volume kernel audit records before indexing to improve signal quality and reduce unnecessary event volume.
Normalized Security Fields
Extracted searchable attributes for users, nodes, API endpoints, HTTP methods, executables, accounts, authentication results, and activity types.
Grafana Security Dashboard
Built monitoring views for activity trends, API access, CVM distribution, audit types, endpoints, users, and privileged execution.
Rule-Level Validation
Evaluated every pipeline rule against captured Nutanix telemetry to identify parsing gaps, detection limitations, and false positive conditions.
Reproducible Deployment Documentation
Documented architecture, setup procedures, field mappings, detection logic, troubleshooting, evaluation findings, and sanitized reference logs.
Key Metrics
Results & Outcome
The integration delivers centralized Nutanix visibility across four CVMs and processes roughly 1.07 messages per second, about 92,000 per day net of the drop rules.
Verifying the 13 rules against live cluster traffic was what hardened the pipeline for production, because six of them behave differently from what their names imply and none of that is visible from a Graylog search alone. The stage match setting decides whether anything parses at all. Three fields receive the entire log line on records that lack an account, executable, or PAM operation. A result field never matches success because the PAM message is single quoted. The v3 API records pass through unparsed. All API audit comes from the single CVM holding the Prism leader role, so no dashboard filter hardcodes a CVM hostname.
The result is a working monitoring pipeline backed by a documented understanding of which security signals can be trusted, which need refinement, and where additional telemetry is needed.
Screenshots & Demo
Nutanix Activity Monitoring Dashboard
Grafana dashboard visualizing Nutanix activity trends and API audit events from normalized Graylog telemetry.
Nutanix OS Audit Processing Pipeline
Graylog pipeline for filtering, parsing, and classifying Nutanix CVM audit logs, including privilege escalation, failed authentication, and configuration change activity.
Nutanix Prism Central Processing Pipeline
Graylog pipeline for parsing Nutanix Prism Central audit, API audit, and flow service logs, with additional classification for API errors, external access, and critical operations.
Nutanix Graylog Pipeline Overview
Overview of the Graylog processing architecture for Nutanix telemetry, showing dedicated pipelines for Prism Central and CVM operating system audit logs.
Nutanix Audit Noise Filtering Rule
Graylog pipeline rule that filters high volume Nutanix auditd events such as syscall, path, process, and execution records before indexing to reduce unnecessary log noise.
Nutanix Audit Field Extraction Rule
Graylog pipeline rule that parses raw Nutanix CVM audit events into normalized fields such as node, audit type, user, executable, operation, session, and authentication result.
Nutanix API Error Detection Rule
Graylog pipeline rule that identifies non successful Nutanix API responses and enriches events with response codes and API error classifications for monitoring and investigation.
Nutanix Configuration Change Detection Rule
Graylog pipeline rule that identifies Nutanix CVM audit events related to configuration changes and tags them for security monitoring and investigation.
Nutanix Graylog Detection and Parsing Rules
Overview of 13 Graylog pipeline rules used to filter, parse, normalize, and classify Nutanix Prism Central and CVM audit telemetry for security monitoring.
Interested in This Project?
Discuss your security needs or explore collaboration opportunities.