Closed wr-sit closed 1 year ago
Hi @wr-sit,
Thanks for writing in!
Can you tell why there are 3 data fields containing a utc timestamp? Is it possible to change this behavior?
As you point out, there is some data redundancy here. The utc_time
and local_time
fields are equivalent for historical reasons (they were initially intended to be different, but due to a bug were both outputting UTC timestamps). In order to keep up compatibility for folks that had built around these outputs, both fields were left as they were and the third field, local_time_adjusted
was added.
This field returns a localized timestamp matching the time zone of the system running the OpenCanary code. If the system time is set to UTC, you'll end up with matching timestamps in the output. At this time the behaviour can't be changed
In the config docs the syslog rfc is mentioned, can you tell me which rfc you used?
The syslog output is built following the RFC5424 specification, as implemented by python's logging.handlers.SysLogHandler
class.
Please do let me know if this sufficiently covers your question or if there's anything else I can help you with.
Hi team,
when I turn on logging to file and to syslog I see the following:
opencanary.log:
{"dst_host": "172.26.0.2", "dst_port": 22, "honeycred": false, "local_time": "2023-06-28 15:51:47.199237", "local_time_adjusted": "2023-06-28 15:51:47.199255", "logdata": {"LOCALVERSION": "SSH-2.0-OpenSSH_5.1p1 Debian-4", "PASSWORD": "ideoteeee", "REMOTEVERSION": "SSH-2.0-OpenSSH_for_Windows_8.1", "USERNAME": "remotepenetrator"}, "logtype": 4002, "node_id": "opencanary-01", "src_host": "10.10.88.61", "src_port": 1906, "utc_time": "2023-06-28 15:51:47.199250"}
syslog message:
<12>opencanaryd[9 :140261098514240]: opencanary-01 WARNING {"dst_host": "172.26.0.2", "dst_port": 22, "honeycred": false, "local_time": "2023-06-28 15:51:47.199237", "local_time_adjusted": "2023-06-28 15:51:47.199255", "logdata": {"LOCALVERSION": "SSH-2.0-OpenSSH_5.1p1 Debian-4", "PASSWORD": "ideoteeee", "REMOTEVERSION": "SSH-2.0-OpenSSH_for_Windows_8.1", "USERNAME": "remotepenetrator"}, "logtype": 4002, "node_id": "opencanary-01", "src_host": "10.10.88.61", "src_port": 1906, "utc_time": "2023-06-28 15:51:47.199250"}
Config file (logger part):
Can you tell why there are 3 data fields containing a utc timestamp? Is it possible to change this behavior? In the config docs the syslog rfc is mentioned, can you tell me which rfc you used?
Many thanks!