[BUG] Mikrotik logs showing as Generic

[amanzella]

I have installed the linux agent on one of our linux servers and made the config changes so that it would listen on 7006 and set Mikrotik to true. I then pointed the MikroTik syslogs to the IP of the linux agent. The connection shows up under Data Sources but it's showing as generic. Also, when using log explorer, the logs are all under Generic and nothing shows up under MikroTik.

[Kbayero]

You could check several things, first check the port to which you are sending the logs from your Mikrotik, the port for this integration is 7007, but I can see that you use the 7006 port. Also check in the integrations that your instance is enabled correctly as follows:

Additionally, you can check the path /opt/utmstack-linux-agent/logs_process/ and check if a firewall_mikrotik.log file has been created where you can find the logs of your Mikrotik.

In case all this is working correctly, please share with us some examples of the logs that are arriving at the generic to process them and see what could be happening.

[amanzella]

@Kbayero Sorry, I had a typo on the port, it is 7007 :)

I have confirmed the linux agent has "log_collector_enabled": true and "firewall_mikrotik": { "enabled": true

The integration in the portal is also enabled.

I have confirmed that firewall_mikrotik.txt is there and the logs are inside of that file.

Here are a few example lines from the file with my IPs changed.

[utm_stack_agent_ds=100.100.100.100]-ipsec,error ::ffff:162.142.125.91 phase1 negotiation failed.
[utm_stack_agent_ds=100.100.100.100]-warning denied winbox/dude connect from 3.81.22.212
[utm_stack_agent_ds=100.100.100.100]-warning denied winbox/dude connect from 3.81.22.212
[utm_stack_agent_ds=100.100.100.100]-warning denied winbox/dude connect from 3.81.22.212
[utm_stack_agent_ds=100.100.100.100]-system,info,account user admin logged in from 100.100.100.200 via winbox
[utm_stack_agent_ds=100.100.100.100]-ipsec,info respond new phase 1 (Identity Protection): ::ffff:100.100.100.300[4500]<=>::ffff:167.94.138.98[57003]
[utm_stack_agent_ds=100.100.100.100]-ipsec,error phase1 negotiation failed due to send error. ::ffff:38.127.15.139[4500]<=>::ffff:167.94.138.98[57003] 4d65822107fcfd52:d8a54bf4d50472fc
[utm_stack_agent_ds=100.100.100.100]-ipsec,error ::ffff:167.94.138.98 phase1 negotiation failed.
[utm_stack_agent_ds=100.100.100.100]-ipsec,info respond new phase 1 (Identity Protection): 100.100.100.100[500]<=>198.20.101.98[37687]

[amanzella]

@Kbayero also to add, if I look in the portal under data processing, it seems the system knows it's a MikroTik log as it shows the counts and generic shows 0. The correlation engine also shows the MT icon.

[Kbayero]

@amanzella We have been checking and it seems like a version problem. Could you provide us with the version and model of your device so we can do a more in-depth review?

[c3s4rfred]

@amanzella We have reviewed the information you provided, you are sending not supported topics in the logs, only firewall topic is supported at the current version, but, we will release a fix soon to make this logs available from Mikrotik integration and not from generic. Thanks for the feed back.

[amanzella]

@c3s4rfred @Kbayero @osmontero I'm just getting back to testing out the system. I updated it to the latest version, and the MikroTik logs are still doing the same.

[c3s4rfred]

Hi @amanzella, we have been doing more tests in our environment and everything is working fine.
Please restart your UTMStack instance, uninstall the agent and install it again, configure the integration and test again.
Also, can U please send us an image with your UTMStack instance version?, can be found at the top-left of the screen inside the application.
Best regards

[amanzella]

@c3s4rfred They are now showing under the MikroTik logs. However, I don't see anything triggering as an alert regarding the MikroTik. I opened up the ports to allow winbox access from the outside as a test, and even though we are getting hammered by login attempts, nothing was triggered. Can you point me to a link to see what rules are out of the box for the Mikrotik?

[c3s4rfred]

Hi @amanzella, at the moment, we don't have Mikrotic rules implemented in UTMStack, but you're welcome to contribute to our rules repository -> https://github.com/utmstack/rules