浙江福彩3d走势图
我們來自五湖四海,不為別的,只因有共同的愛好,為中國互聯網發展出一分力!

OSSEC Monitor your App log file

2013年08月22日16:52 閱讀: 20560 次
OSSEC Monitor your App log file
 
OSSEC monitors system logs with build-in support, and does a good job. Don't forget OSSEC is also can monitor the custom log file like our app's log. You have to create your own decoder and rule for that.
 
Add the log file you want to monitor to ossec.conf
 
Open up 
 
[plain] 
/var/ossec/etc/ossec.conf   
and add below block in.
[html] 
<localfile>  
  <log_format>syslog</log_format>  
  <location>/var/log/my_app.log</location>  
</localfile>  
 
Create a custom decoder
OSSEC uses decoders to parse log files. After it finds the proper decoder for a log, it will parse out fields defined in /var/ossec/etc/decoders.xml, then compare these values to values in rule files - and will trigger an alert when values in the deciphered log file match values specified in rule files.
 
Decoders exist on the servers, not the agents. Custom decoder should be added to /var/ossec/etc/local_decoders.xml on the server.
The log I want to trigger an alert for looks something like this:
 
[html] 
2010-09-25 15:28:42 [node-test]IP:[email protected]  
2010-09-25 15:28:52 [node-test]IP:[email protected]  
2010-09-25 15:29:52 [node-test]IP:[email protected]  
2010-09-25 15:39:52 [node-info]IP:[email protected]  
2010-09-27 16:39:52 [node-info]IP:[email protected]  
 
Open up /var/ossec/etc/local_decoder.xml (you can also use decoder.xml, which already exists, but using local_decoder.xml will assure that you don’t overwrite it on upgrade). First, we want to create a decoder that will match the first part of the log entry. We’ll use the date and first few characters to grab it using a regular expression.
 
The decoder file like below:
[html] 
<decoder name="nodeerror">  
        <prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d [node-test]</prematch>  
</decoder>  
  
<decoder name="nodeerror-alert">  
  <parent>nodeerror</parent>  
  <regex offset="after_parent">IP:(\d+.\d+.\d+.\d+)@(\w+)</regex>  
  <order>url,action</order>  
</decoder>  
 
 
Save your local_decoder.xml and let’s run the log file through ossec-logtest.
 
[plain] 
#/var/ossec/bin/ossec-logtest  
[html] 
2010-09-25 15:28:42 [node-test]IP:[email protected]  
  
  
**Phase 1: Completed pre-decoding.  
       full event: '2010-09-25 15:28:42 [node-test]IP:[email protected]'  
       hostname: 'pms-srv01'  
       program_name: '(null)'  
       log: '2010-09-25 15:28:42 [node-test]IP:[email protected]'  
  
**Phase 2: Completed decoding.  
       decoder: 'nodeerror'  
       url: '192.1.1.1'  
       action: 'reboot'  
  
**Phase 3: Completed filtering (rules).  
       Rule id: '700006'  
       Level: '8'  
       Description: 'reboot happens!'  
**Alert to be generated.  
 
Looks good! It found our decoder and extracted the fields the way we want ‘em. Now, we’re ready to write local rules.
 
 
Write custom rules
 
Open /var/ossec/rules/local_rules.xml, and add below in.
[html] 
<rule id="700005" level="0">  
    <decoded_as>nodeerror</decoded_as>  
    <description>Custom node Alert</description>  
</rule>  
<!-- Alert -->  
<rule id="700006" level="8">  
    <if_sid>700005</if_sid>  
    <action>reboot</action>  
    <options>alert_by_email</options>  
    <description>reboot happens!</description>  
</rule>  
 
Save your local_rules.xml file, Now, we are ready to restart OSSEC and check alert.
 
分享到: 更多
藍客門戶
©2001-2019 中國藍客聯盟 版權所有.
關于藍客聯盟歷史宗旨章程技術服務聯系我們藍客社區

浙江福彩3d走势图 老北京3d推荐号码 快乐双彩走势图 破解极速时时软件 提前知道腾讯在线人数 江苏十一选五 老时时2星怎么买 4码倍投10期方案 彩友会下载 江西新时时中奖qq群 福建31选7开奖计算器