MeshCentral Web Events Logs to Wazuh

[E2674]

Hi all, I am having problems collecting logs to be sent over to Wazuh from my MeshCentral server. Here's what I am trying to achieve:

• Have the wazuh agent collect logs like: web login events, everything done within the web interface, etc.

I have already installed the Wazuh agent in my MeshCentral server and it can collect logs defined in ossec.conf such as auth.log and syslog which are located in /var/log and /var/ossec/logs/active-responses.log respectively.

Based from what I understand, those web login event logs are going inside a database file. In my case, I haven't used MongoDB so NeDB is the default. I saw that those events are in a database file called meshcentral-events.db. So what I did was to create a javascript that would collect the contents of that database file and output it to a .json file --- and then I defined the directory of that JSON file in Wazuh agent's ossec.conf.

I'd also want to add:

• I have configured config.json and defined something like this in the settings section:

"log":[
     "web",
     "webrequest",
     "auth",
     "error"
     ],
    "logFile": "/home/ubuntu/meshcentral-data/meshcentral.log",
    "meshErrorLogPath": "/home/ubuntu/meshcentral-data/mesherror.log"
},

There were no generated files after I did that.

Nonetheless, after trying to do a web login test, it doesn't send it over to my Wazuh manager which is already configured to receive and read JSON files. The JSON file was able to collect contents of the meshcentral-events.db though.

Does anyone know or has already the same experience with Wazuh? Please let me know. Thanks!

[si458]

the is no value called logFile inside the schema file, you should use authLog instead
this will create a fail2ban like file which you can phase and send to your logging system

meshcentral also supports syslog, syslogauth and syslogjson which output information into your syslog file

and you can also specify syslogtcp which sends syslog info over your network via TCP

we sadly dont have any descriptions as to what each values does in the schema file!
if you try each of them and let us know what they do, i can add it into the descriptions for others!

EDIT: below is from the schema file but checking the code, it shows that each value can also be true/false as well as a string

"syslog": {
  "type": "string",
  "default": null
},
"syslogauth": {
  "type": "string",
  "default": null
},
"syslogjson": {
  "type": "string",
  "default": null
},
"syslogtcp": {
  "type": "string",
  "default": null,
  "description": "Send syslog events over the network (RFC3164) to a target hostname:port. For example: localhost:514"
},

[E2674]

Thank you for the swift response. I think I saw a similar line of codes in this website: https://ylianst.github.io/MeshCentral/meshcentral/debugging/#logging-it-all

 "meshErrorLogPath": "/meshcentral/meshcentral-logs/",
    "authLog": "/meshcentral/meshcentral-logs/auth.log",
    "log": [
        "cookie",
        "dispatch",
        "main",
        "peer",
        "web",
        "webrequest",
        "relay",
        "webrelaydata",
        "webrelay",
        "mps",
        "mpscmd",
        "swarm",
        "swarmcmd",
        "agentupdate",
        "agent",
        "cert",
        "db",
        "email",
        "amt",
        "httpheaders",
        "websocket"
    ],

I haven't tried it yet but I'll give it a shot now. I was just worried that if the web events only go in meshcentral-events.db, I wouldn't have a way to send over those logs to my Wazuh manager.

[si458]

well according to the source code syslog / syslogjson / syslogtcp are used inside the DispatchEvent function,
and this function is called everytime something happens like device connect, file transfer, etc.
so give it a try and see what happens!
but in theory syslog diverts it to your local devices syslog file
syslogjson diverts to your local devices syslog file but the event is in a json format
and syslogtcp diverts it over TCP to a remote syslog device (possibly udp as well you would have to test)

[si458]

also with the log option in config.json,
meshcentral will basically log the events you want to a file called log.txt

[E2674]

the auth.log defined from the instructions I've found from the website above:

"meshErrorLogPath": "/meshcentral/meshcentral-logs/",
    "authLog": "/meshcentral/meshcentral-logs/auth.log",
    "log": [
        "cookie",
        "dispatch",
        "main",
        "peer",
        "web",
        "webrequest",
        "relay",
        "webrelaydata",
        "webrelay",
        "mps",
        "mpscmd",
        "swarm",
        "swarmcmd",
        "agentupdate",
        "agent",
        "cert",
        "db",
        "email",
        "amt",
        "httpheaders",
        "websocket"
    ],

Doesn't actually place that file in the directory. I am also getting this error message:
ERROR: Unable to open: /meshcentral/meshcentral-logs/auth.log

I have set the permissions for the meshcentral-logs directory to 664. Am I missing something?

[si458]

I don't think so? I'll have to check code again 2moz to be sure
I have a feeling the log.txt is being placed in the wrong location!
And u specifying a fileName should work but I'm not sure