Yes, I am using local_decoder.xml It does not seem to have any nested group tags. Each group has its own entry.
What logs would you like specifically? On Friday, October 25, 2013 2:18:27 PM UTC-4, dan (ddpbsd) wrote: > > On Fri, Oct 25, 2013 at 2:11 PM, Gabriel Holder > <[email protected]<javascript:>> > wrote: > > Here is my decoder file: > > This is local_decoder.xml correct? > > > <!-- Custom decoder for example --> > > > > <decoder name="php-app"> > > <prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d</prematch> > > </decoder> > > > > <decoder name="php-app-alert"> > > <parent>php-app</parent> > > <regex offset="after_parent">^ (\d+.\d+.\d+.\d+) PHP app</regex> > > <order>srcip</order> > > </decoder> > > > > Rules: > > I'm guessing you put these in local_rules.xml. Do you have nested <group > tags? > > > <group name="syslog,php-app,"> > > <rule id="110000" level="0"> > > <decoded_as>php-app</decoded_as> > > <description>PHP custom app group.</description> > > </rule> > > > > <rule id="110001" level="10"> > > <if_sid>110000</if_sid> > > <srcip>127.0.0.1</srcip> > > <match>Fatal</match> > > <description>php file edited?</description> > > </rule> > > </group> > > > > Logtest gives an error: > > 2013/10/25 14:10:58 ossec-testrule: INFO: Reading local decoder file. > > 2013/10/25 14:10:58 ossec-analysisd: Invalid decoder name: 'php-app'. > > 2013/10/25 14:10:58 ossec-testrule(1220): ERROR: Error loading the > rules: > > 'rules_config.xml'. > > These did not give me any errors. You didn't include log samples so I > can't test any further. > > > > > All I want to do is monitor a specific file for a specific pattern (PHP > > Fatal Error) and alert when it happens. > > > > > > On Friday, October 25, 2013 1:51:26 PM UTC-4, dan (ddpbsd) wrote: > >> > >> On Fri, Oct 25, 2013 at 1:42 PM, Gabriel Holder <[email protected]> > >> wrote: > >> > I am brand new to Ossec and I am trying to monitor an agent's file > >> > /var/path/something/php.log. > >> > > >> > I know I have to setup a decoder and rules for this except for the > life > >> > of > >> > me, I cannot figure any of this out. > >> > Ossec's documentation on accomplishing this is meh at best. > >> > > >> > >> I'll try to integrate this suggestion in the next update. > >> > >> > How can I setup the decoder/rules so that if the file gets edited > with > >> > "PHP > >> > Fatal Error" I am notified? > >> > >> Start by using ossec-logtest to see how the log message is being > >> decoded already. You can add a decoder to > >> /var/ossec/etc/local_decoder.xml on the server if necessary. > >> Then write a rule in /var/ossec/rules/local_rules.xml (on the server > >> of course), possibly referencing the decoder the log message decodes > >> as. > >> > >> I'm not sure how much more help I can be without log samples. > >> > >> > I also cannot figure out WHERE ppl are getting their log lines. > >> > > >> > >> Log files generally. > >> > >> > Any help would be appreciated. > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups > >> > "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, > send > >> > an > >> > email to [email protected]. > >> > For more options, visit https://groups.google.com/groups/opt_out. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
