Here is my decoder file:
<!-- Custom decoder for example -->
<decoder name="php-app">
<prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d</prematch>
</decoder>
<decoder name="php-app-alert">
<parent>php-app</parent>
<regex offset="after_parent">^ (\d+.\d+.\d+.\d+) PHP app</regex>
<order>srcip</order>
</decoder>
Rules:
<group name="syslog,php-app,">
<rule id="110000" level="0">
<decoded_as>php-app</decoded_as>
<description>PHP custom app group.</description>
</rule>
<rule id="110001" level="10">
<if_sid>110000</if_sid>
<srcip>127.0.0.1</srcip>
<match>Fatal</match>
<description>php file edited?</description>
</rule>
</group>
Logtest gives an error:
2013/10/25 14:10:58 ossec-testrule: INFO: Reading local decoder file.
2013/10/25 14:10:58 ossec-analysisd: Invalid decoder name: 'php-app'.
2013/10/25 14:10:58 ossec-testrule(1220): ERROR: Error loading the rules:
'rules_config.xml'.
All I want to do is monitor a specific file for a specific pattern (PHP
Fatal Error) and alert when it happens.
On Friday, October 25, 2013 1:51:26 PM UTC-4, dan (ddpbsd) wrote:
>
> On Fri, Oct 25, 2013 at 1:42 PM, Gabriel Holder
> <[email protected]<javascript:>>
> wrote:
> > I am brand new to Ossec and I am trying to monitor an agent's file
> > /var/path/something/php.log.
> >
> > I know I have to setup a decoder and rules for this except for the life
> of
> > me, I cannot figure any of this out.
> > Ossec's documentation on accomplishing this is meh at best.
> >
>
> I'll try to integrate this suggestion in the next update.
>
> > How can I setup the decoder/rules so that if the file gets edited with
> "PHP
> > Fatal Error" I am notified?
>
> Start by using ossec-logtest to see how the log message is being
> decoded already. You can add a decoder to
> /var/ossec/etc/local_decoder.xml on the server if necessary.
> Then write a rule in /var/ossec/rules/local_rules.xml (on the server
> of course), possibly referencing the decoder the log message decodes
> as.
>
> I'm not sure how much more help I can be without log samples.
>
> > I also cannot figure out WHERE ppl are getting their log lines.
> >
>
> Log files generally.
>
> > Any help would be appreciated.
> >
> > --
> >
> > ---
> > You received this message because you are subscribed to the Google
> Groups
> > "ossec-list" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an
> > email to [email protected] <javascript:>.
> > For more options, visit https://groups.google.com/groups/opt_out.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
