Hello everybody,
I have a Syslog-ng remote log server. In this server i'm installed OSSEC
1.5.1 server, but i have problems with lighttpd (like apache combined
logs). Syslog add header for each log line:
Jul 10 16:13:14 name/x.x.x.x lighttpd[30734]: XXX.X.XXX.X www.XXXX.XXXX
- [10/Jul/2008:16:13:14 +0200] "GET /dsgdfgd HTTP/1.0" 404 345 "-"
"Wget/1.11.1" "-"
test: perl -e 'for($i=0;$i<50;$i++){ system("wget
\"http://www.XXXXX.XXXX/dsgdfgd\"";); }'
I added to ossec.conf:
<localfile>
<log_format>apache</log_format>
<location>/var/ossec/etc/logfiles/access.log</location>
</localfile>
I have <log_format>apache</log_format> but debug mode say: 2008/07/10
16:13:14 ossec-logcollector: DEBUG: Reading syslog message: 'Jul 10
16:13:14 name/x.x.x.x lighttpd[30734]:
decoder.xml:
<decoder name="lighttpd-syslog-ng">
<type>web-log</type>
<prematch>^\S+ \d+ \S+ \S+ \S+ \d+.\d+.\d+.\d+ </prematch>
<regex>^\S+ \d+ \S+ \S+ \S+ (\d+.\d+.\d+.\d+) \S+ \S+ [\S+ \S\d+] </regex>
<regex>"\w+ (\S+) HTTP\S+ (\d+) </regex>
<order>srcip, url, id</order>
</decoder>
local_rules.xml
<rule id="110001" level="10">
<decoded_as>lighttpd-syslog-ng</decoded_as>
<description>Lighttpd</description>
</rule>
Where is the problem?
Thanks.
