wazuh manager not collecting active-responses.log

[J.Carlos A]

Hello,

I have enabled active response in multiple agents and it works fine except files /var/ossec/logs/active-responses.log are not  forwarded to manager or at least they are not shown in manager console nor in /var/ossec/logs/alerts/alerts.log

manager is version 4.7.3 running on RHEL 9 and agents are version 4.7.3 running on RHEL 7.9

all agents have 

 <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

and manager is also configure with

<localfile> <log_format>syslog</log_format> <location>/var/ossec/logs/active-responses.log</location> </localfile>

Please help to debug this error.

thanks

[Nicolas Alejandro Bertoldo]

Hi Carlos,

I hope you are fine.
Have you checked that events are being generated in the active-response.log file?
If so, in order to check if the manager is receiving those events, you can temporarily enable <logall_json>. When this option is enabled, Wazuh stores all events in /var/ossec/logs/archives/archives.json, whether or not they trip a rule. By default, Wazuh archives are disabled because they store a large number of logs on the Wazuh server.

Restart the Wazuh manager to apply the configuration changes:

sudo systemctl restart wazuh-manager

Then you can search for events in the archive, for example:
grep "active-response.json" /var/ossec/logs/archives/archives.json

Note: Don't forget to disable the logall parameter once you have finished troubleshooting. Leaving it enabled could lead to high disk space consumption.

If you do not know how to generate events, you can execute one of the use cases detailed in the documentation: https://documentation.wazuh.com/current/user-manual/capabilities/active-response/ar-use-cases/index.html

I hope this helps. Please let me know how it went.

Regards

[J.Carlos A]

Hi Nicolas,

I have enabled logall_json and nothing is found with grep "active-response.json" /var/ossec/logs/archives/archives.json

If I  run grep "active-response" /var/ossec/logs/archives/archives.json

Then I get multiple lines containing  firewall-drop  logs

I see that in the remote agent the firewall-drop rule is activated, IPtables includes DROP rules activaded by a blacklist rule used as example.

However the rule 651 is not fired and no alert of active response is shown in manager.

thanks

[Nicolas Alejandro Bertoldo]

Hi Carlos,

To do some tests locally, could you share any of the events you get from archives.json?
Please masks all sensitive information, while maintaining its nature.

Regards

[J.Carlos A]

Hi Nicolas,

Please find below some sanitized samples of the logs received in /var/ossec/logs/archives/archives.json :

 

{"timestamp":"2024-06-25T02:51:42.916+0200","agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276702.159189960","full_log":"","decoder":{},"location":"/var/ossec/logs/active-responses.log"}

 

{"timestamp":"2024-06-25T02:51:42.918+0200","agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276702.159189960","full_log":"2024/06/25 02:52:17 active-response/bin/firewall-drop: {\"version\":1,\"origin\":{\"name\":\"firewall-drop\",\"module\":\"active-response\"},\"command\":\"check_keys\",\"parameters\":{\"keys\":[\"12.34.56.78\"]}}","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"data":{"version":"1","origin":{"name":"firewall-drop","module":"active-response"},"command":"check_keys","parameters":{"keys":["12.34.56.78"]}},"location":"/var/ossec/logs/active-responses.log"}

 

 

{"timestamp":"2024-06-25T02:51:42.921+0200","agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276702.159189960","full_log":"2024/06/25 02:52:17 active-response/bin/firewall-drop: {\"version\":1,\"origin\":{\"name\":\"node01\",\"module\":\"wazuh-execd\"},\"command\":\"abort\",\"parameters\":{\"extra_args\":[],\"alert\":{\"timestamp\":\"2024-06-25T02:51:40.783+0200\",\"rule\":{\"level\":10,\"description\":\"blacklistedIP\",\"id\":\"100002\",\"firedtimes\":8,\"mail\":true,\"groups\":[\"blacklist\",\"attack\"]},\"agent\":{\"id\":\"034\",\"name\":\"SERVER01\",\"ip\":\"192.168.1.10\"},\"manager\":{\"name\":\"wazuhserver\"},\"id\":\"1719276700.159163983\",\"full_log\":\"12.34.56.78 - - [25/Jun/2024:02:52:16 +0200] \\\"GET /fakeURL HTTP/1.1\\\" 403 199 \\\"https://fakedomain.demo/index.html\\\" \\\"Mozilla/5.0 (Windows Phone 10.0; Android 4.1.0; Microsoft) Chrome/123.0 \\\" 4\",\"decoder\":{\"name\":\"web-accesslog\"},\"data\":{\"protocol\":\"GET\",\"srcip\":\"12.34.56.78\",\"id\":\"403\",\"url\":\"/fakeURL\",\"host\":\"fakedomain.demo\"},\"location\":\"/opt/apache2/logs/20240625.log\"},\"program\":\"active-response/bin/firewall-drop\"}}","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"data":{"version":"1","origin":{"name":"node01","module":"wazuh-execd"},"command":"abort","parameters":{"extra_args":[],"alert":{"timestamp":"2024-06-25T02:51:40.783+200","rule":{"level":"10","description":"BlacklistedIP","id":"100002","firedtimes":"8","mail":"true","groups":["blacklist","attack"]},"agent":{"id":"034","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276700.159163983","full_log":"12.34.56.78 - - [25/Jun/2024:02:52:16 +0200] \"GET fakeURL HTTP/1.1\" 403 199 \"https://fakedomain.demo/index.html\" \"Mozilla/5.0 (Windows Phone 10.0; Android 4.1.0; Microsoft) Chrome/123.0 \" 4","decoder":{"name":"web-accesslog"},"data":{"protocol":"GET","srcip":"192.168.1.10","id":"403","url":"/fakeURL","host":"fakedomain.demo"},"location":"/opt/apache2/logs/20240625.log"},"program":"active-response/bin/firewall-drop"}},"location":"/var/ossec/logs/active-responses.log"}

 

{"timestamp":"2024-06-25T02:51:42.923+0200","agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276702.159189960","full_l

og":"","decoder":{},"location":"/var/ossec/logs/active-responses.log"}

 

 

{"timestamp":"2024-06-25T02:51:42.925+0200","agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276702.159189960","full_l

og":"2024/06/25 02:52:17 active-response/bin/firewall-drop: Aborted","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"location":"/var/ossec/logs/active-responses.log"}

thanks

[Nicolas Alejandro Bertoldo]

Carlos,

Let me run some tests locally and get back to you with an answer.

Regards

[Nicolas Alejandro Bertoldo]

Hi Carlos, 

Particularly none of the events you have shared generate alerts. Some of them match rule 650, but since it has level="0" it does not generate an alert. You can see this with the help of Wazuh-logtest:

# /var/ossec/bin/wazuh-logtest
Starting wazuh-logtest v4.7.4
Type one log per line

2024/06/25 02:52:17 active-response/bin/firewall-drop: {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"abort","parameters":{"extra_args":[],"alert":{"timestamp":"2024-06-25T02:51:40.783+0200","rule":{"level":10,"description":"blacklistedIP","id":"100002","firedtimes":8,"mail":true,"groups":["blacklist","attack"]},"agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276700.159163983","full_log":"12.34.56.78 - - [25/Jun/2024:02:52:16 +0200] "GET /fakeURL HTTP/1.1" 403 199 "https://fakedomain.demo/index.html" "Mozilla/5.0 (Windows Phone 10.0; Android 4.1.0; Microsoft) Chrome/123.0 " 4","decoder":{"name":"web-accesslog"},"data":{"protocol":"GET","srcip":"12.34.56.78","id":"403","url":"/fakeURL","host":"fakedomain.demo"},"location":"/opt/apache2/logs/20240625.log"},"program":"active-response/bin/firewall-drop"}}

**Phase 1: Completed pre-decoding.
full event: '2024/06/25 02:52:17 active-response/bin/firewall-drop: {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"abort","parameters":{"extra_args":[],"alert":{"timestamp":"2024-06-25T02:51:40.783+0200","rule":{"level":10,"description":"blacklistedIP","id":"100002","firedtimes":8,"mail":true,"groups":["blacklist","attack"]},"agent":{"id":"012","name":"SERVER01","ip":"192.168.1.10"},"manager":{"name":"wazuhserver"},"id":"1719276700.159163983","full_log":"12.34.56.78 - - [25/Jun/2024:02:52:16 +0200] "GET /fakeURL HTTP/1.1" 403 199 "https://fakedomain.demo/index.html" "Mozilla/5.0 (Windows Phone 10.0; Android 4.1.0; Microsoft) Chrome/123.0 " 4","decoder":{"name":"web-accesslog"},"data":{"protocol":"GET","srcip":"12.34.56.78","id":"403","url":"/fakeURL","host":"fakedomain.demo"},"location":"/opt/apache2/logs/20240625.log"},"program":"active-response/bin/firewall-drop"}}'

**Phase 2: Completed decoding.
name: 'ar_log_json'
parent: 'ar_log_json'

**Phase 3: Completed filtering (rules).
id: '650'
level: '0'
description: 'Active Response JSON Messages Grouped'
groups: '['ossec', 'active_response']'
firedtimes: '1'
mail: 'False'


In order to help you I need you to repeat the test that creates the firewall rule and check if the related event is generated in active-responses.log and archives.json. Then please share those events with me. 

Thanks.

[J.Carlos A]

Hi Nicolas,

Thanks to the json viewer I have realized that rule 651 is triggering a level 3 alert

I had previously raised the log alert level to 6 instead of default 6.

Setting  log_alert_level to 3 now shows all  active response actions.

Thanks for your support.