How to monitor nginx logs for file integrity?

[YASHWANTH S]

i am able to monitor syslogs for file integrity but i do not get event alerts for nginx logs 

i added the path of nginx logs in wazuh syscheck module 

<directories check_all="yes" report_changes="yes" realtime="yes">/var/log/nginx/access.log</directories>

but i cant find the event alerts or when default entries are added to the file.

Please Help on this ASAP!

TIA 
Yashwanth.S

[YASHWANTH S]

i am not able to view the log alerts in the wazuh dashboard and they are directed to the archive.log file

How to view the nginx alerts in wazuh dashboard?

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/824d799b-eb4f-4a70-ad44-db32d9d9680an%40googlegroups.com.

[Benjamin Nworah]

Dear Yashwanth S,

Thank you for choosing Wazuh.

You can easily ingest your nginx log into Wazuh. To achieve this, follow the below steps:

1- Add the below configuration on the Wazuh agent by editing the /var/ossec/etc/ossec.conf file

<localfile>

<location>/path/to/nginx/access.log</location>
<log_format>syslog</log_format>
</localfile>

2- Restart the Wazuh agent for your changes to take effect.

systemctl restart wazuh-agent 

    OR 

service wazuh-agent restart

Wazuh has decoders for nginx:

https://github.com/wazuh/wazuh-ruleset/tree/master/decoders

If the above decoders do not match your logs, you an easily create custom decoder and also rules. You can refer to this link to create custom decoder and rules.
https://documentation.wazuh.com/current/user-manual/ruleset/custom.html

Please let me know if this helps.

Regards,

[YASHWANTH S]

i have done that but it is not working and i am not able to view the nginx log changes in the dashboard

[YASHWANTH S]

i am getting logs in security events for nginx but not able to monitor the nginx log file access.log  for file modifications...

[Benjamin Nworah]

Hello YASHWANTH,

Please give me some time to test this use case and revert.

Regards,

[Benjamin Nworah]

Hello Yashwanth,

The file type .log is ignored by default. So either you comment the line as shown below or you remove the .log $.

    <!-- File types to ignore -->
   <!--  <ignore type="sregex">.log$|.swp$</ignore> -->

After commenting or removing the .log$, restart the wazuh agent to apply the changes.

Please let me know if this works.

Regards,