- I am monitoring network traffic on my OpenWRT firewall. I use the
nlbwmon package to monitor and export data, which I then send to a Wazuh server using
rsyslog. The problem is that
nlbwmon exports data in a JSON format that is not standard for Wazuh, and rsyslog just forwards this data within a standard syslog message. To fix this, I wrote an automated script to standardize the nlbwmon data. This script formats the traffic data and places it directly into the msg section of the syslog message, which rsyslog then forwards. Below is an example:
- Then I configured Wazuh Server to process this data:
1. Write a decoder to parsing the traffic data using JSON_Decoder
2. Write a rule with <decoded_as>syslog_custome</decoded_as> options to match and trigger alert
Issue:
When I tested the rule, Wazuh didn't match and trigger alert as I expected. I checked correctly with logtest, Though.
- As you can see, everything seems work correctly. But there's no alert presented on Dashboard
- However, when I replaced character " to \", it worked
Hope someone can help me to explain and fix this issue soon, Thanks