Re: [ossec-list] Re: Can OSSEC analyse a combined syslog file

[loyd.darby]

Don't think format is your issue but look at /var/ossec/etc/decoder.xml, this is where the log format is interpreted. There is a catchall syslog rule that generates the "unknown problem". look at /var/ossec/rules/syslog_rules.xml If any of these word are found <var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var> Then this rule generates the message. <!--   <rule id="1002" level="2">     <match>$BAD_WORDS</match>     <options>alert_by_email</options>     <description>Unknown problem somewhere in the system.</description>   </rule> --> If you were using ossec windows agents instead of syslog, these would be going through msauth_rules.xml instead of syslog_rules.xml.  Seems there would be a way to re-route these.  If your windows events are seeing both sets of rules, you could just suppress the syslog ones for windows.  I get lots of audit failures in my environment and if I were using windows to syslog, all these would trip this alert. On 12/06/2010 02:49 PM, Christopher Moraes wrote: Hi, I have a centralized syslog that contains logs from Windows and Unix hosts (and devices).  The logs are all single line logs, but with different signatures.   E.g. the windows event log format is  Sep 18 00:01:06 TXXXXXX2.syxxxxxd.com MSWinEventLog ....... A sample unix log format is  Sep 18 00:01:02 10.111.114.88 sshd:  ..... I have setup ossec to read the file and specified the <log_format> as "syslog". However, whenever ossec comes across the windows event logs, it throws an alert "Unknown problem somewhere in the system". I went through the syslog_rules.xml and found that this error is caused because the log is not in the format supported by the syslog decoder. Is there anyway I can get ossec to read the log line and check which decoder matches the log before processing the log? Thanks and regards, Chris On Tue, Oct 5, 2010 at 2:58 PM, Christopher Moraes <cmoraes....@gmail.com> wrote: Hi, We're using syslog-ng to centralize logs on a server.   The way the system is setup is that *all* system logs (for unix, windows, apache, iis, etc) get written to a single file on the syslog server.    Can OSSEC be configured to analyse this type of combined syslog file?   Regards, Chris -- R. Loyd Darby, OSSIM-OCSE Project Manager DOC/NOAA/NMFS Infrastructure coordinator Southeast Fisheries Science Center 305-361-4297