Hi Everyone - Does anyone have a custom decoder for Atlassian products or can point me in the correct path to properly identify them?
Here is a sample of what I am dealing with: Bamboo 019-05-23 12:56:11,870 WARN [scheduler_Worker-3] [RemoteAgentManagerImpl] Remote agent 'WINDOWSBUILD.domain.local' was unresponsive and has gone offline. 2019-05-23 12:56:11,870 INFO [scheduler_Worker-3] [AgentManagerImpl] No deployments running on agent WINDOWSBUILD.domain.local 2019-05-23 12:56:11,871 INFO [scheduler_Worker-3] [AgentManagerImpl] No builds running on agent WINDOWSBUILD.domain.local 2019-05-23 12:56:11,902 INFO [AtlassianEvent::0-BAM::EVENTS:pool-3-thread-3] [ChainExecutionManagerImpl] Plan C334-141: - feature-dual-club has finished 2019-05-23 12:56:11,812 WARN [scheduler_Worker-3] [RemoteAgentManagerImpl] Remote agent 'build-dev1.domain.local' was unresponsive and has gone offline. Confluence 2019-05-23 12:56:08,254 INFO [buildTailMessageListenerConnector-124] [FingerprintMatchingMessageListenerContainer] Successfully refreshed JMS Connection 2019-05-23 12:56:11,812 WARN [scheduler_Worker-3] [RemoteAgentManagerImpl] Detected that remote agent 'build1.domain.local' has been inactive since Thu May 23 12:45:50 EDT 2019 2019-05-23 12:56:11,812 WARN [scheduler_Worker-3] [RemoteAgentManagerImpl] Marking remote agent 'build1.domain.local' as unresponsive 2018-08-22 12:11:50,828 INFO [Caesium-1-1] [directory.ldap.cache.AbstractCacheRefresher] 2018-08-22 12:39:03,722 INFO [http-nio-8443-exec-24] [plugins.synchrony.service.SynchronyExternalChangesManager] performExternalChange Started external change for ContentId{id=37322926} 2019-05-02 16:30:00,315 ERROR [NotificationSender:thread-2] [plugin.notifications.dispatcher.NotificationErrorRegistryImpl] addError Error sending notification to server '<Unknown>'(-1) for INDIVIDUAL task (resent 0 times): Error sending to individual 'ff8080815bd4b40a015c7dcb00e80009' on server 'System Mail' Sample decoder output: 2019/05/24 09:19:49 ossec-testrule: INFO: Reading local decoder file. 2019/05/24 09:19:49 ossec-testrule: INFO: Started (pid: 18995). ossec-testrule: Type one log per line. 2019-05-23 12:56:11,812 WARN [scheduler_Worker-3] [RemoteAgentManagerImpl] Remote agent 'chasebuild-dev1.archergroup.local' was unresponsive and has gone offline. **Phase 1: Completed pre-decoding. full event: '2019-05-23 12:56:11,812 WARN [scheduler_Worker-3] [RemoteAgentManagerImpl] Remote agent 'chasebuild-dev1.archergroup.local' was unresponsive and has gone offline.' hostname: '*WARN*' program_name: '(null)' log: '[scheduler_Worker-3] [RemoteAgentManagerImpl] Remote agent 'build-dev1.domain.local' was unresponsive and has gone offline.' **Phase 2: Completed decoding. No decoder matched. The logs are interpreted as syslog and the status is being pulled into the hostname and the only log data I can work with for Phase 2 is the *log:* section correct? So I'll never be able to get the status of the log? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/cf45595d-0e39-42c5-ba03-1664650d6a4b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.