On Tue, Dec 9, 2014 at 7:44 AM, dan (ddp) <[email protected]> wrote: > On Tue, Dec 9, 2014 at 6:59 AM, Martynas Buožis <[email protected]> wrote: >> Hello >> >> I have following in my ossec.conf file on Windows server : >> >> <localfile> >> <location>C:\Windows\sysnative\dhcp\DhcpSrvLog-%a.log</location> >> <log_format>syslog</log_format> >> </localfile> >> >> Messages are coming as enabled in full log (command : logs/archives# tail -f >> archives.log | grep dhcp) and look like : >> >> 2014 Dec 09 13:49:45 (PDC) >> 192.168.100.1->\Windows\sysnative\dhcp\DhcpSrvLog-Tue.log >> 30,12/09/14,13:48:57,DNS Update >> Request,192.168.101.71,host.domain.local,,,0,6,,,,,,,,,0 >> >> PDC is server name, 192.168.100.1 is server IP. >> >> But above message is not recognized by decoder and is not handled by >> ms_dhcp_rules.xml. >> >> ossec-testrule: Type one log per line. >> >> 2014 Dec 09 13:49:45 (PDC) >> 192.168.100.1->\Windows\sysnative\dhcp\DhcpSrvLog-Tue.log >> 30,12/09/14,13:48:57,DNS Update >> Request,192.168.101.71,host.domain.local,,,0,6,,,,,,,,,0 >> >> >> **Phase 1: Completed pre-decoding. >> full event: '2014 Dec 09 13:49:45 (PDC) >> 192.168.100.1->\Windows\sysnative\dhcp\DhcpSrvLog-Tue.log >> 30,12/09/14,13:48:57,DNS Update >> Request,192.168.101.71,host.domain.local,,,0,6,,,,,,,,,0' >> hostname: 'ossec' >> program_name: '(null)' >> log: '2014 Dec 09 13:49:45 (PDC) >> 192.168.100.1->\Windows\sysnative\dhcp\DhcpSrvLog-Tue.log >> 30,12/09/14,13:48:57,DNS Update >> Request,192.168.101.71,host.domain.local,,,0,6,,,,,,,,,0' >> >> **Phase 2: Completed decoding. >> No decoder matched >> >> >> How I can fix that so OSSEC will recognize above message for DHCP ? >> > > What version of Windows is this? The logs don't look anything like the > samples we have for 2008 (2003?). >
Ooooh, I think I see an issue. Did the log sample you provided come from archives.log? If so, it has a header on it "2014 Dec 09 13:49:45 (PDC) 192.168.100.1->\Windows\sysnative\dhcp\DhcpSrvLog-Tue.log ." Remove this header and you have a proper log message. If that log message didn't come from archives.log, find out why it's adding that header onto the message, or modify the decoder.xml to handle it (it's a 5 minute change). >> Many thanks for an advise. >> >> >> With best regards >> Martynas >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
