Built-in Collectors¶

Syslog Collector¶

Syslog Collector collects logs from devices and log sources that follow the Syslog protocol.

You can use Syslog Collector in one of two ways:

1. As a Syslog Collector:

   It collects syslog messages from the source devices, processes the logs, and forwards them to Logpoint. It facilitates direct communication between source devices and Logpoint.

2. As a Proxy Syslog Collector:

   It collects syslog messages from the source device and sends them to Logpoint, acting as a proxy between the source device and Logpoint. It is configured where direct communication between source devices and Logpoint is not possible, such as when there are network restrictions, location restrictions, or security policies in place.

Configuring Syslog Collector in Logpoint

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click the Add collectors/fetchers () icon next to the device.

3. Click Syslog Collector.

Syslog Collector¶

4. Select a Parser, a Processing Policy, and a Charset. If you use Syslog Collector as Proxy, you can’t select Processing Policy. If your Syslog Collector uses proxy, you can’t select Parser and Charset.

5. In Proxy Server, select

   1. None for the device to work as a Syslog Collector.

   2. Use as Proxy to use the device as a proxy.

   If a device not configured as a Proxy sends logs via a syslog proxy device, it is considered malicious, and its events are rejected.

   3. Uses Proxy to collect logs collected through a proxy server. Select the Proxy IP and enter the HostName of the source device, which is case-sensitive.

   

   Syslog Collector (Uses Proxy)¶

A proxy sever can have multiple source devices but each device’s hostname must be unique.

6. Click Submit.

Supported Specification and Syslog Format¶

Syslog Collector supports the RFC 6587 specification for UTF-8 encoded logs with the following formats:

1. RFC 3164

   Standard RFC 3164:

   <PRI> MTH DD HH:MM:SS Hostname LogContent

   For example:

   <12> Aug 12 13:14:59 HostName1 This is test1
   

   RFC 3164 with year:

   <PRI> YYYY MTH DD HH:MM:SS Hostname LogContent

   For example:

   <13> 2015 Apr 8 05:28:13 HostNameA [warning] 1: #1192 Invalid IP resolution
   2015 Apr 8 05:28:13 HostNameA [warning] 1: #1192 Invalid IP resolution
   

2. RFC 5424

   <PRI> [PRIVAL] [FULL-DATE]T[FULL-TIME] Log Content

   Here,

   FULL-DATE = DATE-FULLYEAR “-” DATE-MONTH “-” DATE-MDAY

   FULL-TIME = PARTIAL-TIME TIME-OFFSET

   PARTIAL-TIME = TIME-HOUR “:” TIME-MINUTE “:” TIME-SECOND [TIME-SECFRAC]

   TIME-SECFRAC = “.” 1*6DIGIT

   IME-OFFSET = Z / (“+” / “-“) TIME-HOUR “:” TIME-MINUTE

   For example:

   <165>1 2018-09-14T09:15:15.000003-07:00 Off set value -7
   <165>1 2018-09-14T09:15:15.000003-11:00 Off set value -11
   

Logpoint prioritizes the timezone offset in the log over the device’s timezone when extracting log_ts. If both the device and the log contain timezone information, the log’s timezone offset is used for log_ts.

Before you start receiving logs, you need to configure the settings on the log source. To configure your Linux or Windows machines to forward logs to Logpoint:

Configuration for Linux devices

1. Open the syslog configuration.

   /etc/syslog.conf
   

2. Add your remote server in this format.

   *.*     @logserv.example.com:port
   
   
   Example:-
   
   *.*     @192.168.2.205:514
   

3. Restart Syslog.

Configuring Linux devices for forwarding SSL encrypted log message

1. Install stunnel, and type the following command in the terminal.

   sudo apt-get install stunnel
   

2. Copy /usr/share/doc/stunnel4/examples/stunnel.conf-sample to /etc/stunnel/stunnel.conf.

3. Go to /etc/stunnel/stunnel.conf and modify as follows (create it if doesn’t exist).

   client=yes
   

   Now, on the same config file add:

   [sslsyslog]
   accept  = 127.0.0.1:60515
   connect = 192.168.2.200:515
   

4. Restart the config file with:

   stunnel4/etc/stunnel/stunnel.conf
   

5. Open /etc/syslog.conf with the administrative privilege.

6. Forward the logs to Logpoint server.

   *.*      @@127.0.0.1:60515
   

7. Restart syslogd with:

   service rsyslog restart
   

8. Go to Logpoint server.

9. Select the Linux Device from Settings >> Configuration >> Devices and click Add Collectors/Fetchers.

Configuration for Windows devices

You can forward syslog format logs from Windows devices to Logpoint using third-party agents. We recommended InterSect alliance’s Snare for Windows. The following procedure only applies to Snare for Windows.

1. Go to Network Configuration in Snare.

2. Enter the IP address of your Logpoint in Destination Snare Server Address.

3. Enter port number 514 in the Destination Port.

4. Click Change Configuration.

5. Go to Apply the Latest Audit Configuration and click Reload Settings.

Sequence Numbering in logs collected from Syslog Collector

A sequence number is assigned per device per protocol to each log collected from the Syslog Collector. This helps you identify the order of the logs received from a particular device.

The log collected from a device with the device IP 192.168.0.135 and communicating via the TCP protocol is:

Sequence Number for TCP Log¶

The sequence number for the above log is 41, which is shown as the field value for seq_num_tcp. It means that this log is the 41^st TCP log message received from the device with the device ip 192.168.0.135.

Similarly, the log collected from a device with the device ip 192.168.0.135 and communicating via the UDP protocol is as follows:

Sequence Number for UDP Log¶

The sequence number for the above log is 83, which is shown as the field value for seq_num_udp. It means that this log is the 83^rd UDP log message received from the device with the device ip 192.168.0.135.

And, the log collected from a device with the device ip 192.168.0.135 and communicating via the SSL protocol is as follows:

Sequence Number for SSL Log¶

The sequence number for the above log is 68, which is shown as the field value for seq_num_ssl. It means that this log is the 68^th SSL log message received from the device with the device ip 192.168.0.135.

Configuring Sequence Numbering

When you configure or add sequence numbers to logs, each log is assigned an incremental number starting from 1. Sequence numbering resets when you restart Syslog and when the number of logs reaches 1,000,000,000,000.

1. Go to Settings >> System Settings from the navigation bar and click System Settings.

2. Go to General tab, scroll until you find Sequence Numbering.

3. Select Add sequence numbers on log received from syslog collector.

Configuring Sequence Numbering for logs collected from Syslog Collector¶

4. Click Save.

Snare Collector¶

Snare Collector collects and analyzes logs from the Windows Snare agent.

Configuring Snare Collector in Logpoint

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click the Add collectors/fetchers icon under Actions.

3. Click Snare Collector.

Configuring Snare Collector¶

4. Select a Parser, a Processing Policy, and a Charset from the dropdowns.

5. Click Submit.

Configuration for Windows devices

You can forward syslog format logs from Windows devices to Logpoint using third-party agents. We recommend InterSect Alliance’s Snare for Windows.

To configure Snare for Windows:

1. Go to the Network Configuration tab in the Snare.

2. Enter the IP address of your Logpoint in Destination Snare Server Address.

3. Enter port number 6161 in the Destination Port.

4. Click Change Configuration.

5. Go to Apply the Latest Audit Configuration and click Reload Settings.

FTP Collector¶

FTP Collector collects logs from the files uploaded by users using FTP clients. You can add multiple FTP collectors for a single device. You can use any FTP client to forward logs to the FTP collector. We recommend FTP Rush or Filezilla.

Configuring FTP Collector in Logpoint

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click Add collectors/fetchers icon under Actions.

3. Click FTP Collector to see a list of all the FTP Collectors configured for the device.

FTP Collectors¶

4. Click Add.

Configuring FTP Collector in Logpoint¶

4. Enter a Username and a Password. These credentials are needed to configure settings on the client’s side.

5. Enter a Source Name. This is the unique identifier for the collector.

6. Select a Parser, a Processing Policy, and a Charset to apply over the logs.

7. Click Submit.

Configuring FTP Collector in FTP Clients

To configure FTP Rush or Filezilla:

1. Enter the address of Logpoint in Host.

2. Enter the Username and the Password of the FTP Collector.

3. Use Port 21.

4. Click Enter or Quick Connect to connect to the Logpoint.

5. Drag the log files from the Local site and drop it in the Remote site. The files are now transferred to Logpoint.

SNMP Trap Collector¶

SNMP Trap Collector collects logs from SNMP enabled devices. SNMP traps are alert messages that devices use to notify the SNMP managerthat there are significant events.

Configuring SNMP Trap Collector in Logpoint

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click the Add collectors/fetchers icon under Actions.

3. Click SNMP Trap Collector.

Configuring SNMP Trap Collector in Logpoint¶

4. Choose an SNMP Version.

   • For v_12, enter the Community String.

   • For v_3, enter a Username, Authorization Key, Security Engine ID, and Private Key. The Authorization Key must contain at least 8 characters.

5. Select a Processing Policy to apply over the logs.

6. Click Submit.

Configuring SNMP for Windows

1. Install Simple Network Management Protocol (SNMP) from Turn Windows feature on or off in the Control Panel.

2. Run services.msc command.

3. Search for the SNMP Service. Right click on it and select Properties.

4. Select TRAPS tab.

5. Add Community name and Trap destinations.

6. Click OK.

7. To manually forward different SNMP traps:

   7.1. Run evntwin command and select custom.

   7.2. Click Edit and add the event sources.

   7.3. Click OK.

sFlow Collector¶

sFlow monitors networks, wireless and host devices. Logpoint sFlow Collector forwards counter samples and flow samples using UDP or ARP protocol to Logpoint. Make sure sFlow Package is already installed. The default port number for sFlow protocol is 6343.

Configuring sFlow Collector in Logpoint

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click the Add collectors/fetchers icon under Actions.

3. Click sFlow Collector.

Configuring sFlow Collector in Logpoint¶

4. Select a Processing Policy to apply over the logs.

5. Click Submit.

Starting from Logpoint v6.12.0, the following fields have been renamed according to the Logpoint taxonomy for the sFlow Collector:

File System Collector¶

File System Collector collects logs from Logpoint file systems, allowing you to monitor file access, changes, and other activities. It is only applied to the localhost device. The File System collector processes all the internal logs generated in Logpoint. It captures all the logs from collectors, web servers, mergers, normalizers, services and integrations in Logpoint.

File System Collector can only access logs for files present in /var/log/ and /opt/immune/var/log. If you need to add any file path outside these two locations, contact support.

Configuring File System Collector in Logpoint

1. Go to Settings >> Configuration from the navigation bar and click Devices.

2. Click the Add collectors/fetchers icon under Actions.

3. Click File System Collector.

File System Collectors¶

4. Click ADD.

Configuring File System Collector in Logpoint¶

5. Enter File Path and Exclude Paths.

6. Select a Parser, a Processing Policy, and a Charset.

7. Click Submit.