Wazuh not getting logs from AWS ALB

[Arby Malabo]

Hi Guys,

Recently I added my aws alb for monitoring potential security issues, however I am not getting any logs from the alb, i have followed the steps on the documentation with no error so far. Any idea what to do next?

https://documentation.wazuh.com/current/cloud-security/amazon/services/supported-services/elastic-load-balancing/alb.html

Arby Malabo​​​​  |  Cybersecurity Engineer

o: +63 (917) 142 2685

www.dwmorgan.com

[Pablo Ariel Gonzalez]

Hi Arby,

Could you share the configuration you have applied inside the ossec.conf file and the logs of ossec when you do a restart of the service?

With that information we might have some indication of where the error is occurring so we can analyze it.

[Arby]

Hey Pablo,

sorry for the late reply, please see conf below.

<wodle name="aws-name">
    <disabled>no</disabled>
    <interval>10m</interval>
    <run_on_start>yes</run_on_start>
    <skip_on_error>yes</skip_on_error>
    <bucket type="alb">
      <name>my-alb</name>
      <path>my-alb-path</path>
      <aws_profile>default</aws_profile>
    </bucket>
  </wodle>