search

amitn322 / blackesk

BLACK ESK SIEM is a SIEM platform built with Elasticsearch, Syslog-Ng and Kibana
29 stars 12 forks source link

extras/loggen.sh logs to the host #2

Closed czanik closed 4 years ago

czanik commented 4 years ago

I tried to find the 10 log messages generated during installation, but found only syslog-ng internal() messages. Taking a closer look at extras/loggen.sh I found, that:

logger -t sshd -f /tmp/ssh_logs.txt

Which means, that logs are sent to the local syslog instead of the one just installed in Docker. The above command only works, if logs from localhost are forwarded to port 514 even before installation.

logger -T --rfc3164 -n 127.0.0.1 -P 514 -t sshd -f /tmp/ssh_logs.txt

The above variant should resolve this problem.

amitn322 commented 4 years ago

Thanks a lot , I will update the script to send over to the syslog on docker. I did go back and check the script and looks like I am generating the logs only after all the build stuff is completed. The logs should still be in the Elasticsearch, may be some timing issue ? I had that timing issue when I had the VM that i run the dockers put on sleep at times. I will look into it tonight !

On 7/24/2020 1:23 AM, Peter Czanik wrote:

I tried to find the 10 log messages generated during installation, but found only syslog-ng internal() messages. Taking a closer look at extras/loggen.sh I found, that:

|logger -t sshd -f /tmp/ssh_logs.txt |

Which means, that logs are sent to the local syslog instead of the one just installed in Docker. The above command only works, if logs from localhost are forwarded to port 514 even before installation.

|logger -T --rfc3164 -n 127.0.0.1 -P 514 -t sshd -f /tmp/ssh_logs.txt |

The above variant should resolve this problem.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/amitn322/blackesk/issues/2, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAN7V5SO2BS6EKWFNSYDRZDR5FAG3ANCNFSM4PGPXKMA.

amitn322 commented 4 years ago

@czanik I fixed this issue. The reason you weren't seeing the generated logs wasn't because syslog was sent to local, rather it was because of the timezone. Also the logger was running after the installation was complete. I did however, update to your style, I like that better. Thanks again !