Shulou(Shulou.com)06/01 Report--

Configure OSSEC SYSLOG output (all agent)

Edit the ossec.conf file (default is / var/ossec/etc/ossec.conf)

Add the following to ossec.conf (10.0.0.1 is the server that receives the syslog)

10.0.0.1 9000 default

Enable OSSEC to allow syslog output

/ var/ossec/bin/ossec-control enable client-syslog

Restart the OSSEC service

/ var/ossec/bin/ossec-control start configure LOGSTASH

Add (or create) the following to the configuration file in logstash: (suppose 10.0.0.1 is the ES server, and the file name is logstash-ossec.conf)

Input {udp {port = > 9000 type = > "syslog"} filter {if [type] = = "syslog" {grok {match = > {"message" = > "% {SYSLOGTIMESTAMP:syslog_timestamp}% {SYSLOGHOST:syslog_host}% {DATA:syslog_program}: Alert Level:% {BASE10NUM:Alert_Level}; Rule:% {BASE10NUM:Rule} -% {GREEDYDATA:Description} Location:% {GREEDYDATA:Details} "} add_field = > [" ossec_server ","% {host} "]} mutate {remove_field = > [" syslog_hostname "," syslog_message "," syslog_pid "," message "," @ version "," type " "host"]}} output {elasticsearch_http {host = > "10.0.0.1"}} recommended Kibana dashboard

According to the common needs of ossec, some people in the community have made dashboard that can be loaded and used directly from Kibana3 pages.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.