>> I've tested on IIS 7.5 and IIS 8.5, and both systems work flawlessly >> for the built-in decoders in OSSEC. I even tested with Nexpose and >> they both work.
>Can you please post a log sample that you know decodes properly and for which >the rules hit as they should? It would be nice to get to the bottom of >this. I haven't seen a log sample of IIS 7.5 and IIS 8.5 "flawlessly" decoding and triggering on default web rules so I was hoping someone would step up and show a decoded IIS log triggering on a web rule. >From what I can tell on a logtest only the parent decoder displays so I think >it would be tricky to know for sure which decoder was used last. I checked log samples from IIS 7, IIS 8, ISS 8 in the azure cloud and they all extract URL at least, but none seem to trigger on a simple SQL injection rule I had been previously advised that the documentation says all log fields must be checked (Yep did that a couple of years ago but I double checked anyway). I have also heard to just use something else to analyze IIS log events (and this is likely the best path for me at this point). I like the flexibility OSSEC gives me but I am pretty darn sure IIS logs will not trigger on web rules which is a shame. I guess I must be in the minority with using OSSEC to monitor IIS logs, or something in my setup is wrong, or folks just assume OSSEC is helping them watch IIS logs. I am just putting this topic back out there in case anything new had happened with it. James Whittington -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Michael Starks Sent: Saturday, December 13, 2014 11:50 To: [email protected] Subject: Re: [ossec-list] Re: anyone know the status of the issue where IIS logs are not able to trigger on web_rules.xml On 12/12/2014 06:02 PM, Brent Morris wrote: > It should be noted that the decoders seem fine for me (and I suspect > everyone else). I think that github issue is bogus. I think it is correct, but of course I could have made a mistake. > Follow what I posted above... basically, IIS Manager > Default Web > Site >> Logging > Log File Format: W3C - select fields. *Check all the >> boxes > that are not checked*!!!!! I think there were 4 that weren't checked. > > Edit your OSSEC config on that box... > > <localfile> > <location>C:\inetpub\logs\LogFiles\W3SVC1\u_ex%y%m%d.log</location> > <log_format>iis</log_format> > </localfile> > > I've tested on IIS 7.5 and IIS 8.5, and both systems work flawlessly > for the built-in decoders in OSSEC. I even tested with Nexpose and > they both work. Can you please post a log sample that you know decodes properly and for which the rules hit as they should? It would be nice to get to the bottom of this. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
