Page Comparison

...

The Fedora Servers logs analysis App automatically Collect - Read - Parse - Analyzes - Reports all machine generated log data of the server and presents a comprehensive set of graphs and reports to analyze machine generated data. Use a predefined set of dashboards and gadgets widgets to  visualize visualize and address the system software, code written, and infrastructure during development, testing, and production. This logs analysis App helps measure, troubleshoot, and optimize your servers integrity, stability and quality with the several visualization and investigation dashboards.

...

1. The Fedora App is running on messages/syslog, auth/secure, mail, kern, cron and audit standard logs.
   When adding/editing the logs to XpoLog it is mandatory to apply the correct log type(s) to each of the logs:
   1. fedora - all logs that the application will analyze must have fedora as a log type.
      
   2. linux - all logs that the application will analyze must have linux as a log type.
   3. messages/syslog - only the messages /syslog logs must also be configured to have messages as a log type.
   4. secure - only the auth/ secure logs must also be configured to have secure as have auth as a log type.auth
   5. cron - - only the auth/secure logs cron log must also be configured to have authcron as a log type.
   6. cron maillog - only the cron mail log must also be configured to have cronmail as a log type.
   7. maillog kernel - only the mail kern log must also be configured to have mail as kernel as a log type.kernel
   8. audit - only the kern log must also be configured to have audit as a log type.
   9. dnf - only the kern dnf log must also be configured to have kernel dnf as a log type.audit
   10. ufw -  only only the kern ufw log must also be configured to have audit ufw as a log type.
   
   
2. Once the required information is set, on each log click next and edit the log pattern, this step is crucial to the accuracy and deployment of the fedora App. Use the following patterns for each of the logs:
   
   1. fedora Fedora messages /syslog log:
      First Pattern:
      {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}: [{text:time-taken,ftype=time-taken;,}] {text:Message,ftype=message}
      Second Pattern:
      {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}{block,start,emptiness=true}[{text:pid,ftype=pid}]{block,end,emptiness=true}:{regexp:User,ftype=accountid;refName=message,([passed|failed|closed|opened] for user |password for invalid user |password for |USER=| user \u0027| user )[XPLG_PARAM([^\s\.\u005D\u0027]+)].*}{regexp:Sourceip,ftype=sourceip;refName=Message,(\d+\.\d+\.\d+\.\d+).*} {text:Message,ftype=message;,}
      fedora auth/
      
   2. Fedora secure log:
      {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}{block,start,emptiness=true}[{text:pid,ftype=pid}]{block,end,emptiness=true}:{regexp:User,ftype=accountid;refName=message,([passed|failed|closed|opened] for user |changed password expiry for\s|password for invalid user |password for |password changed for\s|USER=|User unknown:\s|unknown user:\s|user \u0027|user=|user | user:\sname=)[XPLG_PARAM([^\s\.\u005D\u0027\,\u003A\u0028]+)].*}{regexp:Sourceip,ftype=sourceip;refName=Message,(\d+\.\d+\.\d+\.\d+).*}{regexp:Group,ftype=group;refName=Message,(group\s'|group:\sname=|group added.*name=)[XPLG_PARAM([^'\s,]+)].*} {regexp:uid,ftype=uid;refName=Message,uid=([^\s\u0029]+).*}{regexp:rhost,ftype=rhost;refName=Message,rhost=([^\s]+),*}{text:Message,ftype=message;,}
      
      
   3. fedora cron Fedora cron log:
      {date:Date,MMM dd HH:mm:ss} {text:Server,ftype=server} {text:Process,ftype=process}{block,start,emptiness=true}[{text:pid,ftype=pid}]{block,end,emptiness=true}: {text:Message,ftype=message}
      
      
   4. fedora mail Fedora mail log:
      {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}{block,start,emptiness=true}[{number:process id}]{block,end,emptiness=true}: {regexp:session,refName=Message;ftype=session,^(\w+):}{regexp:From,refName=Message;ftype=from,\s+from=\u003C?([^\u003E,]+)}{regexp:To,refName=Message;ftype=to,\s+to=\u003C?([^\u003E,]+)}{regexp:Size,refName=Message;ftype=size,size=([^\s,]+).*}{regexp:Class,refName=Message;ftype=class,class=([^\s,]+).*}{regexp:nrcpts,refName=Message;ftype=nrcpts,nrcpts=([^\s,]+).*}{regexp:msgID,refName=Message;ftype=msgid,msgid=<([^>]+).*}{regexp:Proto,refName=Message;ftype=protocol,proto=([^\s,]+).*}{regexp:Stat,refName=Message;ftype=status,stat=([^\s,]+).*}{regexp:Relay,refName=Message;ftype=relay,relay=([^\s,]+).*}{string:Message,ftype=message;,}
      
      
      
   5. fedora kernel Fedora kernel log:
      {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}:{block,start,emptiness=true} [{text:time-taken,ftype=time-taken;,}]{block,end,emptiness=true} {text:Message,ftype=message}
      fedora
      
   6. Fedora audit log:
      First Pattern:
      type={text:typeType,ftype=eventid}{map:Event Description,ftype=eventdescription;refIndex=0,file:knowledge/repository/system/linux/map/linux-audit.prop}{map:Category,ftype=category;refIndex=0,file:knowledge/repository/system/linux/map/linux-audit-categories.prop} msg=audit({timestamp:Date,yyyy-MM-dd HH:mm:ss.SSS}:{text:Message ID}): {regexpproperties:pid,refName=Message,\spid=([0-9]*)}{regexp:uid,ftype=uid;refName=Message,[^a,s]uid=([0-9]*)[^:]}{regexp:auid,ftype=auid;refName=Message,(new auid=|[^old] auid=)[XPLG_PARAM([0-9]*)]}{regexp:old auid,refName=Message,old auid=([0-9]*)}{regexp:ses,ftype=sessionid;refName=Message,(new ses=|[^old] ses=)[XPLG_PARAM([0-9]*)]}{regexp:old ses,refName=Message,old ses=([0-9]*)}{regexp:subj,refName=Message,subj=([^ ]*)}{regexp:kind,refName=Message,kind=values,keysSep==;propSep=space;,pid#_#ftype=pid#_#name=PID;uid#_#name=UID;auid#_#ftype=auid;old-auid#_#ftype=oldauid#_#name=Old auid;ses#_#ftype=sessionid#_#name=Sessionid;sub;tty;old-ses;res;proctitle;arch;syscall;success;exit;items}msg=''{properties:msg,keysSep==;propSep=space;,op#_#ftype=op#_#name=OP;exe#_#ftype=exe;hostname#_#ftype=machine#_#name=Hostname;addr#_#ftype=sourceip;terminal#_#ftype=terminal#_#name=Terminal;res#_#ftype=status#_#name=Status;acct#_#ftype=accountid;fp#_#ftype=fp;kind#_#ftype=kind;direction#_#ftype=direction;spid#_#ftype=spid;suid#_#ftype=suid;rport#_#ftype=rport#_#name=Rport;port#_#ftyperport#_#name=Port;comm#_#ftype=comm;unit#_#ftype=unit;id#_#ftype=uid#_#name=ID}''{regexp:New Name,ftype=newname;refName=OP,new name:\s+([^\s]+).*}{regexp:fp,New GID,ftype=newgid;refName=Message,fp=([^\s]*OP,new gid:\s+(\d+)}{regexp:directionOperation,ftype=directionoperation;refName=MessageOP,direction=([^\su003B]+).*)}{regexp:spid,refName=Message,spid=([0-9]*)}{regexp:suid,ftype=suid;refName=Message,suid=([0-9]*)}{regexp:acct,ftype=accountid;refName=Message,acct="([^"]*)}{regexp:rport,ftype=rport;refName=Message,rport=([0-9]*)}{regexp:lport,ftype=lport;refName=Message,lport=([0-9]*)}{regexp:port,ftype=port;refName=Message,\sport=([0-9]*)}{regexp:exe,ftype=exe;refName=Message,exe="([^"]*)
      Second Pattern:
      type={text:Type,ftype=eventid}{map:Event Description,ftype=eventdescription;refIndex=0,file:knowledge/repository/system/linux/map/linux-audit.prop}{map:Category,ftype=category;refIndex=0,file:knowledge/repository/system/linux/map/linux-audit-categories.prop} msg=audit({timestamp:Date,yyyy-MM-dd HH:mm:ss.SSS}:{text:Message ID}): {properties:values,keysSep==;propSep=space;,pid#_#ftype=pid#_#name=PID;uid#_#name=UID;auid#_#ftype=auid;old-auid#_#ftype=oldauid#_#name=Old auid;ses#_#ftype=sessionid#_#name=Sessionid;sub;tty;old-ses;res;proctitle;arch;syscall;success;exit;items;acct#_#ftype=accountid;exe#_#ftype=exe;hostname#_#ftype=machine#_#name=Hostname;addr#_#ftype=sourceip;terminal#_#ftype=terminal#_#name=Terminal;subj;msg;grantors;op#_#ftype=op#_#name=OP;fp#_#ftype=fp;kind#_#ftype=kind;direction#_#ftype=direction;spid#_#ftype=spid;suid#_#ftype=suid;rport#_#ftype=rport#_#name=Rport;port#_#ftyperport#_#name=Port;comm#_#ftype=comm;unit#_#ftype=unit}{regexp:New Name,ftype=newname;refName=MessageOP,new name:\s+([^\s]+).*}{regexp:New GID,ftype=newgid;refName=MessageOP,new gid:\s+([^\s]d+).*}{regexp:UIDOperation,ftype=uidoperation;refName=Message,msg=\u0027op.*id=OP,([^\su003B]+).*}{regexp:OPStatus,ftype=operationstatus;refName=Messageres,\u0027op=([^\u003B]w+).*(id|acct)}{regexp:hostname,ftype=machine;refName=Message,hostname=([^,\s]*)}{regexp:addr,ftype=sourceip;refName=Message,[^l]addr=([^\s]*)}{regexp:terminal,ftype=terminal;refName=Message,terminal=([^\s ]*)}{regexp:res,ftype=status;refName=Message,res=(.*)\u0027}{string:Message,ftype=message} 
      
      g. Fedora dnf log:
      {date:Date,yyyy-MM-dd'T'HH:mm:ssZ} {priority:Priority,ftype=priority,INFO;NOTICE;WARN;WARNING;DEBUG;DDEBUG;SUBDEBUG;CRITICAL} {string:Message,ftype=message}
      
      h. Fedora ufw log:
      {date:Date,MMM dd HH:mm:ss} {text:Hostname.ftype=hostname} {text:Process,ftype=process}: [{text:Kernel Time,ftype=kerneltime}] [{text:LogPrefix,ftype=logprefix}] {properties:Message,keysSep==;propSep=space;,IN#_#ftype=interfacein;OUT#_#ftype=interfaceout;MAC#_#ftype-mac;SRC#_#ftype=sourceip;DST#_#ftype=targetip;LEN#_#ftype=length#_#name=Payload Length;TOS#_#ftype=servicetype#_#name=Type Of Service;PREC#_#ftype=precedence#_#name=Precedence;TTL#_#ftype=ttl;ID#_#ftype=id#_#name=Identification;PROTO#_#ftype=protocol;SPT#_#ftype=sourceport#_#name=SourcePort;DPT#_#ftype=targetport#_#name=TargetPort;WINDOW#_#name=windowssize;RES#_#ftype=flags#_#name=TCP Flags;URGP}