But I cannot change it, it's a log automatically generated from the 
application.

On Tuesday, 7 May 2013 08:50:00 UTC+10, Jb Cheng wrote:
>
> Either use 'July 04' format, or add an extra space after 'July ' and it 
> can be decoded correctly.   
> - -  -
> Jul  4 09:42:16 enigma sshd[11990]: Accepted password for dcid from 
> 192.168.2.10 port 35259 ssh2
>
>
> On Thursday, May 2, 2013 7:14:19 PM UTC-7, Giovanni P wrote:
>>
>> Hi all,
>>
>> I am using "OSSEC HIDS v2.7 - Trend Micro Inc." in local mode.
>>
>> I forward logs via syslog to OSSEC from ~20 servers. All working fine, 
>> but today I noticed a (bug?) problem in the pre-decoding phase of the log 
>> analysis.
>>
>> This is the output of logtest on some SSHd example log:
>>
>> *Jul 4 09:42:16* enigma sshd[11990]: Accepted password for dcid from 
>>> 192.168.2.10 port 35259 ssh2
>>>
>>>
>>> **Phase 1: Completed pre-decoding.
>>>        full event: 'Jul 4 09:42:16 enigma sshd[11990]: Accepted password 
>>> for dcid from 192.168.2.10 port 35259 ssh2'
>>>        hostname: 'myossechost'
>>>        *program_name: '(null)'*
>>>        log: 'Jul 4 09:42:16 enigma sshd[11990]: Accepted password for 
>>> dcid from 192.168.2.10 port 35259 ssh2'
>>>
>>> **Phase 2: Completed decoding.
>>>        No decoder matched.
>>>
>> And second version is:
>>
>> *Jul 04 09:42:16* enigma sshd[11990]: Accepted password for dcid from 
>>> 192.168.2.10 port 35259 ssh2
>>>
>>>
>>> **Phase 1: Completed pre-decoding.
>>> full event: 'Jul 04 09:42:16 enigma sshd[11990]: Accepted password for 
>>> dcid from 192.168.2.10 port 35259 ssh2'
>>> hostname: 'enigma'
>>> *program_name: 'sshd'*
>>> log: 'Accepted password for dcid from 192.168.2.10 port 35259 ssh2'
>>>
>>> **Phase 2: Completed decoding.
>>> decoder: 'sshd'
>>> dstuser: 'dcid'
>>> srcip: '192.168.2.10'
>>>
>>> **Phase 3: Completed filtering (rules).
>>> Rule id: '5715'
>>> Level: '3'
>>> Description: 'SSHD authentication success.'
>>> **Alert to be generated.
>>>
>>
>> The time stamp is different, the first log is missing a digit into the 
>> day number. Of course this issue is valid for all the logs and prevent the 
>> rules relying on <program_name> to works (there are quite a lot).
>> Do you guys identified this issue, or is just my misconfiguration? (I 
>> know that I can change it on rsyslogd templates, I was just wondering if 
>> there is already a fix or something is in progress.)
>>
>>
>> - Giovanni
>>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.


Reply via email to