Introduction
This document will explain the checks for logging for your syslog log source. When you apply the control steps in this document, it will assist you in identifying the problem you are experiencing with logging or in your testing process.
Debugging
Click Settings > Integrations > Data Collection to open the source list. Open the action menu (the ≡ icon) at the right of the source you want to check and click Search. Logsign opens the search page with a query for that source (for example EventSource.IP:"10.10.11.35" EventSource.Description.raw:"<source name>") and today's date range. If a host name is defined for the source, the query uses EventSource.HostName instead of the IP address. The Search item is not shown when Leaf Mode is active.
In the debugging section, log capturing scenarios will be checked by making an SSH connection to the logsign syslog IP and then sniffing with the ngrep process.
Determine the IP address to be used for SSH based on the logsign model you are using:
- If you are using a cluster structure for your logsign model, proceed by making an SSH connection to your syslog IP.
- If you are using a single (Standalone) logsign model, make an SSH connection to the logsign IP with a single IP address.
Make an SSH connection to Logsign to access root privileges.
1- The following steps must be applied to ensure that logs are coming to logsign.
A. Run the command below to sniff the log traffic coming from the log source.
After defining the IP address to be 10.10.11.35 according to the log source where logs are taken, you can run the following command.
Bash$: ngrep -W byline port 514 and host 10.10.11.35
Port 514 is the UDP syslog port. If the source sends syslog over TCP, use port 515 in the command (ngrep -W byline port 515 and host 10.10.11.35). For TLS syslog the collector listens on TCP 6514; the payload is encrypted, so ngrep only shows that the connection arrives.
Do not close this window for a short time, as you need to see the raw form of the log that comes in the traffic of the log source on this screen.
You can also capture raw logs without an SSH session. Go to Settings > Maintenance > Log Capture Tool, enter the source IP address in Sender filter (or * for all senders, or a comma-separated list of IPs), select the Port (514 (UDP) or 515 (TCP)) and the Auto-stop time (5, 15 or 30 min), then click Start Capture. Incoming raw logs are listed under Captured logs, and you can download them with Export. The menu item is visible to users who have the log capture permission.
B. After seeing the sniffed traffic, we can check the logs of our integration we added as a source from the user interface approximately 1 minute later.
Query : EventSource.IP:"10.10.11.35"
If Logs Do Not Appear in the User Interface
C. If you have successfully completed the B item above, you can skip this item. If you cannot see the logs in the user interface, follow the steps below.
Check the time of the source by looking at the sniffed log.
If the time information in the marked area is different from the current time, update the time on the source where the logs will be received. The analysis of logs whose time is behind or ahead can be more complicated. Analyze sources with incorrect time information based on Time.Received: on the search page, click the date range, select Time.Received in Time Column and click Apply.
If Logs Do Not Reach Logsign
2- For the situation where logs do not come to Logsign, you can check the following steps:
A- Firewall Permissions
Log source > Logsign SIEM Syslog IP > UDP 514 Port should be allowed. If the source sends syslog over TCP, allow TCP 515; for TLS syslog, allow TCP 6514.
If Logsign firewall integration is made, you can check firewall logs from Logsign user interface with the query 'Source.IP:10.10.11.35 Destination.Port:514 Destination.IP:10.10.11.40'. If you see traffic like Deny or Drop, you need to define the firewall rule.
If you receive firewall logs and cannot see the traffic logs of the log source (10.10.11.35), check steps B and C.
B-Network Structure
The network traffic that will enable communication between the log source and Logsign should have the necessary configurations for the vlan, route, and security products you use.
C- The configurations applied to the log source should be reviewed. The Ngrep command applied in Step 1 listens to the logs coming to Logsign. Since we do not see any log output in the sniffed ngrep, the problem is not with Logsign, but with the source or network/network devices between them. Control processes should be carried out from these sources.