search

ossec / ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
http://www.ossec.net
Other
4.44k stars 1.04k forks source link

csyslogd syslog_output not working with custom_alert_output #1362

Open midasi opened 6 years ago

midasi commented 6 years ago

The OSSEC deployment within OSSIM uses custom_alert_output, rather than the default log format. We were trying to send these alerts to our central syslog server, and enabled syslog_output, as we have done on other OSSEC deployments. On the OSSIM deployment, the logs do not get forwarded, although the alerts.log contains the alerts in the custom format. We removed the custom_alert_output setting in ossec.conf and the logs get forwarded as expected.

ddpbsd commented 6 years ago

It's a known consequence of custom alert formats. I don't think maild will work with custom alert logs either.

midasi commented 6 years ago

OK, thank you. We didn't find a hint in the documentation mentioning this.

Do you plan to fix this issue or do we have to modify csyslogd by ourselves? And is it possible to change the csyslogd behaviour to retrieve the alerts directly (zeromq?) instead of reading the alerts.log?

ddpbsd commented 6 years ago

It is possible to change csyslogd to use zeromq to get the alerts. I had started this a long time ago, but never got around to finishing it.

midasi commented 6 years ago

That would be great! In the meantime we try to use a workaround with jsonout_output and rsyslog.