Is it possible to add old apache logs to the wazuh agent?

[Anak Kampung]

Hi, Every One

I just installed the wazuh agent on a new server for me to use to investigate an incident.

I will add the apache log from the web server computer (which does not have the wazuh agent installed) and I will enter the apache log into the wazuh agent for me to analyze the apache log data.

The question is whether I can do this, because the apache log that I will enter comes from a different server computer.

I have tried to configure the wazuh agent as below.

    <local file>
      <log_format>apache</log_format>
      <location>/var/log/apache2/access_log-backup.log</location>
    </local files>

and the result is that the log data cannot be displayed on the wazuh dashboard. Is there an error in the apache log configuration that I did in the wazuh agent ossec.conf file.

[Benjamin Nworah]

Dear Anak,

Thank you for using Wazuh!

To monitor a log file on a system (assuming a Linux endpoint) that has Wazuh agent installed, kindly follow the below steps.

1- Add the below configuration on the Wazuh agent by editing the /var/ossec/etc/ossec.conf file
<localfile>

<location>/PATH_TO_APACHE_LOG/</location>
<log_format>syslog</log_format>
</localfile>

Where PATH_TO_APACHE_LOG represents the full path to the apache log. For example if you save your apache log in a log file named apache.log that is located in /var/log/. The above configuration will take this format.

<localfile>

<location>/var/log/apache.log</location>
<log_format>syslog</log_format>
</localfile>

2- Restart the Wazuh agent for your changes to take effect.
systemctl restart wazuh-agent 

    OR 

service wazuh-agent restart

Wazuh has default decoder and rules for apache logs:

https://github.com/wazuh/wazuh-ruleset/blob/master/decoders/0025-apache_decoders.xml

https://github.com/wazuh/wazuh-ruleset/blob/master/rules/0250-apache_rules.xml

If the above decoders do not match your logs, you can easily create a custom decoder and also rules. You can refer to this link to create custom decoder and rules.
https://documentation.wazuh.com/current/user-manual/ruleset/custom.html

Please let me know if this helps

Regards,

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/a5e32fcc-fe1e-41c7-9d2f-582bd78d80b7n%40googlegroups.com.

[Anak Kampung]

Hi Benjamin,

Thanks for your response,  in this case I have 2 (two) servers  one, One as a web server and one as just a wazuh agent. and I have backed up the apache log from the web server and I will use it on the wazuh agent for me to investigate a threat that has occurred on the web server, in this case the apache log file from the backup from the web server I have stored in the /var/log/apache2/access_log-backup.log directory on the wazuh agent server, and on the wazuh agent I have made two configuration attempts as below.
first try:

     <local files>

       <log_format>apache</log_format>
       <location>/var/log/apache2/access_log-backup.log</location>
     </local files>

However, the problem is that the Apache log data cannot be displayed on the Wazuh dashboard.

I have also configured according to your information, but the problem has not been resolved.

[Benjamin Nworah]

  Dear Anak,

The Wazuh is not aware of your web server, since you don't have the Wazuh agent installed on it. So our focus will be on the device that has the Wazuh agent installed.

First your configuration should take the below format (the one you are using is not correct). please copy and past the below configuration within the <ossec_config> block in the Wazuh agent ossec.conf file.

<localfile>

<location>/var/log/apache2/access_log-backup.log</location>

<log_format>syslog</log_format>
</localfile>

Restart the wazuh agent to apply your new changes.

I need to point something out here, the Wazuh agent will monitor for changes in the file /var/log/apache2/access_log-backup.log., if nothing changed in the file nothing will be reported to Wazuh server. Hence, Wazuh agent performs real-time monitoring of the log file to report when something changes.

Again, you can use the Wazuh-logtest https://documentation.wazuh.com/current/user-manual/ruleset/testing.html#using-the-wazuh-dashboard-and-the-command-line-tool to check if there are any default decoders and rules to parse and map your logs in the file /var/log/apache2/access_log-backup.log., if there is none, you will have to create custom decoders/rules to parse your logs and make it visible on the Wazuh dashboard. You can refer to the below link to create custom decoders and rules for your logs.

https://documentation.wazuh.com/current/user-manual/ruleset/custom.html

Hope this helps.

Regards,