On Fri, Oct 25, 2013 at 2:11 PM, Gabriel Holder <[email protected]> wrote: > Here is my decoder file:
This is local_decoder.xml correct? > <!-- Custom decoder for example --> > > <decoder name="php-app"> > <prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d</prematch> > </decoder> > > <decoder name="php-app-alert"> > <parent>php-app</parent> > <regex offset="after_parent">^ (\d+.\d+.\d+.\d+) PHP app</regex> > <order>srcip</order> > </decoder> > > Rules: I'm guessing you put these in local_rules.xml. Do you have nested <group tags? > <group name="syslog,php-app,"> > <rule id="110000" level="0"> > <decoded_as>php-app</decoded_as> > <description>PHP custom app group.</description> > </rule> > > <rule id="110001" level="10"> > <if_sid>110000</if_sid> > <srcip>127.0.0.1</srcip> > <match>Fatal</match> > <description>php file edited?</description> > </rule> > </group> > > Logtest gives an error: > 2013/10/25 14:10:58 ossec-testrule: INFO: Reading local decoder file. > 2013/10/25 14:10:58 ossec-analysisd: Invalid decoder name: 'php-app'. > 2013/10/25 14:10:58 ossec-testrule(1220): ERROR: Error loading the rules: > 'rules_config.xml'. These did not give me any errors. You didn't include log samples so I can't test any further. > > All I want to do is monitor a specific file for a specific pattern (PHP > Fatal Error) and alert when it happens. > > > On Friday, October 25, 2013 1:51:26 PM UTC-4, dan (ddpbsd) wrote: >> >> On Fri, Oct 25, 2013 at 1:42 PM, Gabriel Holder <[email protected]> >> wrote: >> > I am brand new to Ossec and I am trying to monitor an agent's file >> > /var/path/something/php.log. >> > >> > I know I have to setup a decoder and rules for this except for the life >> > of >> > me, I cannot figure any of this out. >> > Ossec's documentation on accomplishing this is meh at best. >> > >> >> I'll try to integrate this suggestion in the next update. >> >> > How can I setup the decoder/rules so that if the file gets edited with >> > "PHP >> > Fatal Error" I am notified? >> >> Start by using ossec-logtest to see how the log message is being >> decoded already. You can add a decoder to >> /var/ossec/etc/local_decoder.xml on the server if necessary. >> Then write a rule in /var/ossec/rules/local_rules.xml (on the server >> of course), possibly referencing the decoder the log message decodes >> as. >> >> I'm not sure how much more help I can be without log samples. >> >> > I also cannot figure out WHERE ppl are getting their log lines. >> > >> >> Log files generally. >> >> > Any help would be appreciated. >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
