Sending data to Auditconsole via mlogc

In this article, How to Sending data to Auditconsole via mlogc? Step-by-step configure Auditconsole and mlog. Auditconsole recevie audit-event data from modsecurity module. Auditconsole  mlogc

Configure Mlogc and Modsecurity

Links:
Sending data to Auditconsole via mlogc
AuditConsole failed to restart after crash

Auditconsole mlogc

Configure mlogc.conf in folder /modsecurity/mlogc/mlogc.conf

CollectorRoot       “/var/log/mlogc”
ConsoleURI          https://CONSOLE_IP_ADDRESS:8080/rpc/auditLogReceiver
SensorUsername      “name-sensor”
SensorPassword      “password-sensor”
LogStorageDir       “data”

Note:

• ConsoleURI: ip address of Auditconsole
• SensorUsername and SensorPassword: create in Auditconsole

Configure modsecurity.conf

SecAuditEngine RelevantOnly
SecAuditLogType Concurrent
SecAuditLogParts ABIDEFGHZ
SecAuditLogStorageDir /var/log/mlogc/data

Note:

• SecAuditLogStorageDir same with CollectorRoot/LogStorageDir inmlogc.conf
• Running mlogc will create 2 file mlogc-error.log and mlogc-transaction.log.

Running Command to sending log to Auditconsole

# cd /path/to/modsecurity/mlogc
# ./mlogc-batch-load.pl /var/log/mlogc/data /opt/mod_security/mlogc/mlogc /opt/mod_security/mlogc/mlogc.conf

View error in file mlogc-error.log using command

# tailf /var/log/mlogc/mlogc-error.log

Error mlogc

[Sat Apr 26 05:00:23 2014] [1] [22610/0] Failed to create global mutex: No space left on device
[Sat Apr 26 05:00:23 2014] [3] [22610/0] ModSecurity Audit Log Collector 2.8.0-RC1 terminating with error 1
[Sat Apr 26 05:00:34 2014] [3] [22612/0] Configuring ModSecurity Audit Log Collector 2.8.0-RC1.
[Sat Apr 26 05:00:34 2014] [3] [22612/0] Delaying execution for 5000ms.
[Sat Apr 26 05:00:39 2014] [1] [22612/0] Failed to create global mutex: No space left on device
[Sat Apr 26 05:00:39 2014] [3] [22612/0] ModSecurity Audit Log Collector 2.8.0-RC1 terminating with error 1
[Sat Apr 26 05:10:47 2014] [3] [22634/0] Configuring ModSecurity Audit Log Collector 2.8.0-RC1.
[Sat Apr 26 05:10:47 2014] [3] [22634/0] Delaying execution for 5000ms.
[Sat Apr 26 05:10:52 2014] [1] [22634/0] Failed to create global mutex: No space left on device
[Sat Apr 26 05:10:52 2014] [3] [22634/0] ModSecurity Audit Log Collector 2.8.0-RC1 terminating with error 1

Solve problem : Auditconsole  mlogc

# echo 512 32000 100 512 > /proc/sys/kernel/sem

Error Permistion create
Assume path to data contain logs in folder /path/to/logs/data

# chmod 755 /path /path/to
# chmod 770 /path/to/logs /path/to/logs/data
#chmod g+s /path/to/logs/data

Note: Set permistion folder /path/to/logs/data to create logs modsecurity 7(rwx) 5(rx)

Conclusion: Sending data to Auditconsole via mlogc  help easy monitoring logs of modsecurity. Auditconsole  mlogc