spiderlabs / modsecurity-mlogc-ng Goto Github PK
View Code? Open in Web Editor NEWNext generation remote logging tool for ModSecurity, supporting native and JSON format.
Next generation remote logging tool for ModSecurity, supporting native and JSON format.
I gave mlogc-ng an honest try after initially being very hesitant..
There's no documentation whatsoever, except for this little excerpt from mlogc-ng.c:
/*
* mlogc-ng
*
* TODO: write something about it.
*
*/
Some minimal usage instructions would be nice... i just want to be able to export my logs to JSON..or any format that's not modsec_audit's native format
Hi, anyone
root@webwash01:~/modsecurity-mlogc-ng# ./mlogc-ng mlog-new.frank
configuration.c:80:read_configuration_file(): Problem creating pipe element: transform_to_json
mlogc-ng.c:53:main(): Problems reading the configuration file: mlog-new.frank
root@webwash01:~/modsecurity-mlogc-ng# cat mlog-new.frank
{
"mlogc_pipeline":[
{
"read_from_filesystem":{
"directory":"/var/asl/data/audit"
}
},
{
"transform_to_json":{
}
},
{
"send_to_server":{
"host":"http://ls01.x.no:31311",
"username":"frank",
"password":"x",
"validate_certificate_chain":"false",
"number_of_clients": 10
}
},
{
"dump": {
"id": "true",
"audit_file": "true"
}
}
]
}
Hello, I made config file from mlogc-ng.conf.example.
but when I write ./mlogc-ng /mlogc-ng.conf ;
it writes:
mlogc-ng.c:53:main(): Problems reading the configuration file: /mlogc-ng.conf
what should I do?
Best regards.
Hi,
Just to mention that the example configs are wrong regarding the "check_persistence" and "store_database" keys.
In the code, it is actually "persistence" and "directory" respectively.
When I use these, I get a segmentation fault:
stat("/applogs/waf/data/20180719/20180719-1343/20180719-134331-153200781148.157322", {st_mode=S_IFREG|0644, st_size=9612, ...}) = 0
open("/applogs/waf/data/20180719/20180719-1343/20180719-134331-153200781148.157322", O_RDONLY) = 7
fstat(7, {st_mode=S_IFREG|0644, st_size=9612, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd38ba89000
read(7, "---OVtnH4Lu---A--\n[19/Jul/2018:1"..., 8192) = 8192
read(7, ""] [tag "OWASP_TOP_10/A1"] [tag "..., 4096) = 1420
close(7) = 0
munmap(0x7fd38ba89000, 4096) = 0
stat("/applogs/waf/persistence/1532/0078/1148/.157/322/", {st_mode=S_IFDIR|0755, st_size=6, ...}) = 0
mkdir("/applogs/waf/persistence/1532", 0777) = -1 EEXIST (File exists)
mkdir("/applogs/waf/persistence/1532/0078", 0777) = -1 EEXIST (File exists)
mkdir("/applogs/waf/persistence/1532/0078/1148", 0777) = -1 EEXIST (File exists)
mkdir("/applogs/waf/persistence/1532/0078/1148/.157", 0777) = -1 EEXIST (File exists)
mkdir("/applogs/waf/persistence/1532/0078/1148/.157/322", 0777) = -1 EEXIST (File exists)
open("/applogs/waf/persistence/1532/0078/1148/.157/322/", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EISDIR (Is a directory)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0} ---
+++ killed by SIGSEGV +++
Segmentation fault
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.