Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
5.2.5 Restart “rsyslog”
opensourcesim:~# /etc/init.d/rsyslogd restart
5.2.6 Check whether the new entries are written in the new log file
opensourcesim:/etc/ossim/agent/plugins# tail -f /var/log/last_logon.log
Jul 14 19:38:49 dmz01 LOGON_EXAMPLE: > root pts/2 localhost Wed Jul 14 19:38 still logged in
Jul 14 19:38:54 dmz01 LOGON_EXAMPLE: > root pts/2 localhost Wed Jul 14 19:38 - 19:38 (00:00)
Jul 14 19:38:59 dmz01 LOGON_EXAMPLE: > ossim pts/2 localhost Wed Jul 14 19:38 still logged in
Jul 14 19:40:51 dmz01 LOGON_EXAMPLE: > ossim pts/2 localhost Wed Jul 14 19:38 - 19:40 (00:01)
Jul 14 20:15:09 dmz01 LOGON_EXAMPLE: > reboot system boot 2.6.31.6 Wed Jul 14 17:39 - 20:15 (02:35)
5.2.7 Create a plugin file
Copy an existing plugin to build the new one on the existing structure
opensourcesim:/etc/ossim/agent/plugins# cp syslog.cfg example.cfg
Set the new plugin specific parameters
;; Building Plugins Example
;; plugin_id: 9001
;; type: detector
[DEFAULT]
plugin_id=9001
[config]
type=detector
enable=yes
source=log
# Enable syslog to log everything to one file. Add it to log rotation also.
# echo "*.* /var/log/all.log" >> /etc/syslog.conf; killall -HUP syslogd
#location=/var/log/all.log
location=/var/log/last_logon.log
# create log file if it does not exists,
# otherwise stop processing this plugin
create_file=true
process=
start=no
stop=no
startup=
shutdown=
## rules
[Rule 01 - Console Session Open]
# Jul 14 20:36:47 dmz01 LOGON_EXAMPLE: > root tty1 Wed Jul 14 20:36 still logged in
event_type=event
regexp="^(?P(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+(?P[^\s]+)\s+LOGON_EXAMPLE:
>\s+(?P[^\s]+)\s+(?Ptty\d+)\s+(?P.*still logged in.*))$"
sensor=\_CFG(plugin-defaults,sensor)
Page 26 Copyright © Alienvault 2010