mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-13 21:36:00 +03:00
77 lines
2.7 KiB
Plaintext
77 lines
2.7 KiB
Plaintext
ModSecurity Audit Log Collector (mlogc)
|
|
|
|
Mlogc is used to connect a ModSecurity sensor to the central
|
|
audit log repository.
|
|
|
|
To Install:
|
|
===========
|
|
|
|
1) Copy the mlogc executable to an appropriate location.
|
|
|
|
A good location might be /usr/local/bin, /opt/mlogc/bin, etc.
|
|
|
|
2) Create sensor in the central audit log repository. Note the
|
|
username and the password (SENSOR_USERNAME, SENSOR_PASSWORD).
|
|
Also note the IP address central repository listens on
|
|
(CONSOLE_IP_ADDRESS).
|
|
|
|
3) Configure the ModSecurity sensor to use mlogc
|
|
|
|
# Use ReleventOnly auditing
|
|
SecAuditEngine RelevantOnly
|
|
|
|
# Must use concurrent logging
|
|
SecAuditLogType Concurrent
|
|
|
|
# Send all audit log parts
|
|
SecAuditLogParts ABIDEFGHZ
|
|
|
|
# Use the same /CollectorRoot/LogStorageDir as in mlogc.conf
|
|
SecAuditLogStorageDir /var/log/mlogc/data
|
|
|
|
# Pipe audit log to mlogc with your configuration
|
|
SecAuditLog "|/usr/local/bin/mlogc /etc/mlogc.conf"
|
|
|
|
4) Using the mlogc-default.conf as a template, configure the logger.
|
|
|
|
Typically these are the only directives that will need to be modified
|
|
to conform to your site:
|
|
|
|
# Points to the root of the installation. All relative
|
|
# paths configured in this file will be resolved with the
|
|
# help of this path (LogStorageDir, TransactionLog, etc.)
|
|
#
|
|
# Typically, this will be the parent directory that is configured
|
|
# in ModSecurity for the SecAuditLogStorageDirectory. So, if
|
|
# your SecAuditLogStorageDirectory is set to /var/log/mlogc/data,
|
|
# then set this to /var/log/mlogc.
|
|
CollectorRoot "/var/log/mlogc"
|
|
|
|
# ModSecurity Console receiving URI. You can change the host
|
|
# and the port parts but leave everything else as is.
|
|
ConsoleURI https://CONSOLE_IP_ADDRESS:8886/rpc/auditLogReceiver
|
|
|
|
# Sensor credentials
|
|
SensorUsername "SENSOR_USERNAME"
|
|
SensorPassword "SENSOR_PASSWORD"
|
|
|
|
# Base directory where the audit logs are stored. This can be specified
|
|
# as a path relative to the CollectorRoot, or a full path. It should
|
|
# resolve to the same path as ModSecurity's SecAuditLogStorageDirectory.
|
|
LogStorageDir "data"
|
|
|
|
See the mlogc-default.conf configuration file for details on other
|
|
configuration directives.
|
|
|
|
5) Restart the ModSecurity sensor.
|
|
|
|
From now on every audit log generated will go to the repository. Make
|
|
sure you create an alert. Transactions without alerts will be recorded
|
|
but not displayed on the home page.
|
|
|
|
To troubleshoot, generate alerts and observe file "mlogc-error.log".
|
|
|
|
If mlogc fails to connect to the server it will pause for a period
|
|
of time (60 seconds by default) before it will try again.
|
|
|