Purpose
This guide explains how to send EfficientIP SOLIDserver DDI logs to Logsign USO over syslog. Logsign USO parses the DNS server (named) and DHCP server (dhcpd) messages that SOLIDserver writes, including DNS Guardian trigger messages, and classifies them as DNS, DHCP and suspicious behavior events.
Prerequisites
- Administrator access to the SOLIDserver appliance or its management interface, so that you can set a remote syslog destination.
- Network connectivity from SOLIDserver to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
- A Logsign USO release that includes the EfficientIP SOLIDserver parser. Contact Logsign Support if you are not sure which release you run.
Step 1: Forward SOLIDserver Logs to Logsign USO
Configure SOLIDserver to send its system logs to a remote syslog server and enter the IP address and port of the Logsign USO collector as the destination. The menu path for remote syslog depends on your SOLIDserver release, so follow the EfficientIP documentation for your version.
Make sure the DNS and DHCP services send their messages to syslog. DNS query and answer lines appear only when query logging is enabled on the DNS service. Without it, Logsign USO still receives DNS Guardian, resolver error and general named messages, but no per query events.
Step 2: Add the Data Source in Logsign USO
Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select EfficientIP as the vendor and SOLIDserver as the product, and enter the IP address that the SOLIDserver logs arrive from as the host. Click Save.
Supported Message Formats
Logsign USO accepts RFC 3164 (BSD) syslog lines whose program name is named or dhcpd. The host name after the timestamp is optional, because some SOLIDserver appliances send no host name. Lines from other programs (for example sshd or syslogd) are not parsed by this integration. Examples:
Nov 10 16:14:05 named[17069]: client 10.3.4.84#54746 (wpad.example.com.): answer: wpad.example.com. IN A (10.3.4.27) -> NXDOMAIN
Nov 10 16:12:12 dns01 named[17069]: client @0x7ee2b158 192.0.2.27#34229 (example.com): query: example.com IN A +E(0)K (192.0.2.187)
Nov 10 16:13:23 named[17069]: ARMING trigger on 192.168.3.157 (action:LOG) (Suspicious Behavior 328, 4)
Nov 10 16:13:55 dhcpd[20866]: DHCPACK on 192.168.8.47 to 38:14:28:93:cf:28 (laptop-01) via 192.168.8.1 [86400]
Event Classification
Each event gets an EventMap, a severity and a vendor ID. The System ID is the prefix 4537 followed by the vendor ID (for example 4537101).
| Message | EventMap (Context / Type / SubType) | Severity | Vendor ID |
|---|---|---|---|
| DNS answer, NOERROR | Network / DNS / Response | information | 101 |
| DNS answer, NXDOMAIN | Network / DNS / Response | information | 102 |
| SERVFAIL | Network / DNS / Error | error | 103 |
| REFUSED | Network / DNS / Error | error | 104 |
| DNS format error (FORMERR) | Network / DNS / Error | error | 105 |
| DNS query | Network / DNS / Request | information | 106 |
Other named messages and unknown response codes | Network / DNS / Info | information | 100 |
| DNS Guardian ARMING trigger | Security / Suspicious Behavior / Detect | warning | 201 |
| DNS Guardian DISARMING trigger | Security / Suspicious Behavior / Info | information | 202 |
| DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPINFORM | Network / DHCP / Info | information | 301 to 303, 306 |
| DHCPACK | Network / DHCP / Lease | information | 304 |
| DHCPRELEASE | Network / DHCP / Release | information | 305 |
| DHCPNAK, DHCPDECLINE | Network / DHCP / Error | error | 307, 308 |
| No free leases | Network / DHCP / Error | error | 309 |
| Failover pool balance | Network / DHCP / Info | information | 310 |
Other dhcpd messages | Network / DHCP / Info | information | 300 |
Parsed Fields
DNS events fill Source.IP and Source.Port (the client), DNS.Host, DNS.Class, DNS.Record, DNS.Response and Server.IP. For answers that carry A or AAAA records, DNS.IP holds the returned addresses as a comma separated list. Format and resolver errors also fill Destination.IP and Destination.Port with the upstream server.
DNS Guardian events fill Source.IP, Source.MAC when the trigger key contains one, Event.Action (for example LOG or QUARANTINE) and Rule.Name.
DHCP events fill Event.Action with the DHCP message type, Source.IP, Source.MAC, Source.HostName, DHCP.Lease (lease time in seconds) and either Destination.IP (relay address) or Source.Interface. In every event the full message is kept in Event.Note and the program name in Event.Prefix.
Notes and Limits
- The RFC 3164 timestamp has no year and no time zone. Set the SOLIDserver clock to the same time zone as Logsign USO so that Time.Generated is correct.
- RFC 5424 headers are not supported by this parser. Keep the SOLIDserver syslog output in the BSD format.
- DNS query logging can produce a high event volume. Take it into account when you plan EPS.
Verification
- In Logsign USO, open Settings > Data Collection and confirm that the SOLIDserver source is receiving data.
- Resolve a name through the SOLIDserver DNS service from a client. In Search, look for events with Vendor EfficientIP and Product SOLIDserver. The answer appears with EventMap Network / DNS / Response and the client address in Source.IP.
- If the source receives data but events are not parsed, check that the lines still start with a BSD syslog timestamp and that the program name is
namedordhcpd. A relay that rewrites the header can stop parsing.