rsyslog and Wazuh

[exe]

Greetings,

we want to use rsyslog to capture for example Sonicwall logs, but I'm a bit stuck right now.

I set up a rsyslog Server but don't know how to keep going from here on out.

We have multiple Sonicwalls but I just dont know how to set it up properly and test it to see that it really captures it.

I would really appreciate some guidance :D 

Thank you all, you are all doing an amazing job!

[Stuti Gupta]

Hi  exeteste,

You need to configure rsyslog on the endpoint where the Wazuh agent is installed. The installation steps for the Wazuh agent are here:
https://documentation.wazuh.com/current/installation-guide/wazuh-agent/index.html

To configure rsyslog, edit the file /etc/rsyslog.conf and add a rule to store logs from the SonicWall device into a specific file. For example:

# Store messages from the remote device
if $fromhost-ip startswith '<REMOTE_DEVICE_IP>' then /var/log/<FILE_NAME>.log
& ~

You can refer to this documentation for syslog forwarding:
https://documentation.wazuh.com/current/cloud-service/your-environment/send-syslog-data.html

After rsyslog starts storing the SonicWall logs into a file, configure the Wazuh agent to monitor that file using a localfile entry in ossec.conf. For example:

<localfile>
<log_format>syslog</log_format>
<location>/path/to/sonicwall/logfile.log</location>
</localfile>

refer:
https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/index.html

Update the configuration with your correct log path and format, then restart the agent.

Once this is done, check the agent log to confirm the file is being monitored:

cat /var/ossec/logs/ossec.log | grep <log file name>

If the file is being monitored, check the Wazuh dashboard to see if alerts appear.
If you do not see any alerts or events, enable archives logging to confirm whether logs are being received.
Documentation:
https://documentation.wazuh.com/current/user-manual/manager/event-logging.html
Note: enabling archives.json consumes disk space and is not recommended for production environments.

If the logs appear in archives.json but not on the dashboard, the issue is most likely that no default decoders or rules match your SonicWall logs.  You need to create custom rules and decide based on those logs https://documentation.wazuh.com/current/user-manual/ruleset/index.html

Let me know if you need any further help.