OSSEC Monitor your App log file

发布时间：2014-09-05 14:00:17作者：知识屋

OSSEC monitors system logs with build-in support, and does a good job. Don't forget OSSEC is also can monitor the custom log file like our app's log. You have to create your own decoder and rule for that.

Add the log file you want to monitor to ossec.conf

Open up

[plain]

/var/ossec/etc/ossec.conf

and add below block in.

[html]

<log_format>syslog</log_format>

</localfile>

Create a custom decoder

OSSEC uses decoders to parse log files. After it finds the proper decoder for a log, it will parse out fields defined in /var/ossec/etc/decoders.xml, then compare these values to values in rule files - and will trigger an alert when values in the deciphered log file match values specified in rule files.

Decoders exist on the servers, not the agents. Custom decoder should be added to /var/ossec/etc/local_decoders.xml on the server.

The log I want to trigger an alert for looks something like this:

[html]

2010-09-25 15:28:42 [node-test]IP:192.1.1.1@reboot.

2010-09-25 15:28:52 [node-test]IP:192.1.1.1@reboot.

2010-09-25 15:29:52 [node-test]IP:192.1.1.1@reboot.

2010-09-25 15:39:52 [node-info]IP:192.1.1.1@reboot.

2010-09-27 16:39:52 [node-info]IP:192.1.1.1@reboot.

Open up /var/ossec/etc/local_decoder.xml (you can also use decoder.xml, which already exists, but using local_decoder.xml will assure that you don’t overwrite it on upgrade). First, we want to create a decoder that will match the first part of the log entry. We’ll use the date and first few characters to grab it using a regular expression.

The decoder file like below:

[html]

</decoder>

<parent>nodeerror</parent>

<order>url,action</order>

</decoder>

Save your local_decoder.xml and let’s run the log file through ossec-logtest.

[plain]

#/var/ossec/bin/ossec-logtest

[html]

2010-09-25 15:28:42 [node-test]IP:192.1.1.1@reboot.

**Phase 1: Completed pre-decoding.