Free BSD

Owned by Nadav Razam (Unlicensed)
Last updated: Dec 11, 2023 by Eran
2 min read

  1. Background

    The Linux for Free BSD Servers logs analysis App automatically Collect - Read - Parse - Analyzes - Reports all machine generated log data of the server and presents a comprehensive set of graphs and reports to analyze machine generated data. Use a predefined set of dashboards and widgets to visualize and address the system software, code written, and infrastructure during development, testing, and production. This Linux for Free BSD logs analysis App helps measure, troubleshoot, and optimize your servers integrity, stability and quality with the several visualization and investigation dashboards.

    Steps:

    1. The Linux App for Free BSD is running on messages, secure, mail, kern and cron standard logs.
      When adding/editing the logs to XpoLog it is mandatory to apply the correct log type(s) to each of the logs:

      1. freebsd - all logs that the application will analyze must have freebsd as a log type.

      2. linux - all logs that the application will analyze must have linux as a log type.

      3. messages - only the messages logs must also be configured to have messages as a log type.

      4. auth - only the auth logs must also be configured to have auth as a log type.

      5. cron - only the cron log must also be configured to have cron as a log type.

      6. mail - only the mail log must also be configured to have mail as a log type.

      7. kernel - only the kern log must also be configured to have kernel as a log type.

      8. audit - only the audit log must also be configured to have audit as a log type.

      9. dnf - only the dnf log must also be configured to have dnf as a log type.

      10. ufw - only the ufw log must also be configured to have ufw as a log type.

      11. userlog - only the userlog log must also be configured to have audit and userlog as log types.


    2. Once the required information is set, on each log click next and edit the log pattern, this step is crucial to the accuracy and deployment of the Linux App. Use the following patterns for each of the logs:

      1. FreeBSD messages log:
        {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}{block,start,emptiness=true}[{text:pid,ftype=pid}]{block,end,emptiness=true}: {text:Message,ftype=message;,}{regexp:User,ftype=user;refName=message,[passed|failed] for (.*) from}

      2. FreeBSD auth log:
        {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}{block,start,emptiness=true}[{text:pid,ftype=pid}]{block,end,emptiness=true}:{regexp:User,ftype=accountid;refName=message,([passed|failed|closed|opened] for user |changed password expiry for\s|password for invalid user |password for |password changed for\s|USER=|User unknown:\s|unknown user:\s|user \u0027|user=|user | user:\sname=)[XPLG_PARAM([^\s\.\u005D\u0027\,\u003A\u0028]+)].*}{regexp:Sourceip,ftype=sourceip;refName=Message,(\d+\.\d+\.\d+\.\d+).*}{regexp:Group,ftype=group;refName=Message,(group\s'|group:\sname=|group added.*name=)[XPLG_PARAM([^'\s,]+)].*} {regexp:uid,ftype=uid;refName=Message,uid=([^\s\u0029]+).*}{regexp:rhost,ftype=rhost;refName=Message,rhost=([^\s]+),*}{text:Message,ftype=message;,}

      3. FreeBSD cron log:
        {date:Date,MMM dd HH:mm:ss} {text:Server,ftype=server} {text:Process,ftype=process}{block,start,emptiness=true}[{text:pid,ftype=pid}]{block,end,emptiness=true}: {text:Message,ftype=message}

      4. FreeBSD mail log:
        {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}{block,start,emptiness=true}[{number:process id}]{block,end,emptiness=true}: {regexp:session,refName=Message;ftype=session,^(\w+):}{regexp:From,refName=Message;ftype=from,\s+from=([^,]+)}{regexp:To,refName=Message;ftype=to,\s+to=([^,]+)}{text:Message,ftype=message;,}

      5. FreeBSD kernel log:
        {date:Date,MMM dd HH:mm:ss} {text:source,ftype=source} {text:process name,ftype=process;,}: [{text:time-taken,ftype=time-taken;,}] {text:Message,ftype=message}

      6. FreeBSD audit log:
        header,{number:BytesInRecord},{number:Version_Number},{text:eventName,ftype=eventName},{number:Number3},{date:Date,EEE MMM dd HH:mm:ss yyyy}, +{string:Process_Time}{eol}{regexp:status,ftype=status;refName=Record,return,(\w+)}{regexp:Failure_Message,refName=Record,failure : ([^,]*)}{regexp:Message,ftype=message;refName=Record,text,([^\n]*)}{regexp:AuditUserId,ftype=username;refName=Record,subject.*?,([^,]*)}{regexp:EffectiveUserID,refName=Record,subject.*?,.*?,([^,]*)}{regexp:EffectiveGroupID,refName=Record,subject.*?,.*?,.*?,([^,]*)}{regexp:RealUserID,refName=Record,subject.*?,.*?,.*?,.*?,([^,]*)}{regexp:RealGroupID,refName=Record,subject.*?,.*?,.*?,.*?,.*?,([^,]*)}{regexp:ProcessID,refName=Record,subject.*?,.*?,.*?,.*?,.*?,.*?,([^,]*)}{regexp:SessionID,ftype=sessionid;refName=Record,subject.*?,.*?,.*?,.*?,.*?,.*?,.*?,([^,]*)}{regexp:Port,refName=Record,subject.*?,.*?,.*?,.*?,.*?,.*?,.*?,.*?,([^,]*)}{regexp:TerminalIp,ftype=sourceip;refName=Record,subject.*?,.*?,.*?,.*?,.*?,.*?,.*?,.*?,.*?,([^\n]*)}{string:Record}trailer,{number:trailer_number}

      7. FreeBSD dnf log:
        {date:Date,yyyy-MM-dd'T'HH:mm:ssZ} {priority:Priority,ftype=priority,INFO;NOTICE;WARN;WARNING;DEBUG;DDEBUG;SUBDEBUG;CRITICAL} {string:Message,ftype=message}

      8. FreeBSD ufw log:
        {date:Date,MMM dd HH:mm:ss} {text:Hostname.ftype=hostname} {text:Process,ftype=process}: [{text:Kernel Time,ftype=kerneltime}] [{text:LogPrefix,ftype=logprefix}] {properties:Message,keysSep==;propSep=space;,IN#_#ftype=interfacein;OUT#_#ftype=interfaceout;MAC#_#ftype-mac;SRC#_#ftype=sourceip;DST#_#ftype=targetip;LEN#_#ftype=length#_#name=Payload Length;TOS#_#ftype=servicetype#_#name=Type Of Service;PREC#_#ftype=precedence#_#name=Precedence;TTL#_#ftype=ttl;ID#_#ftype=id#_#name=Identification;PROTO#_#ftype=protocol;SPT#_#ftype=sourceport#_#name=SourcePort;DPT#_#ftype=targetport#_#name=TargetPort;WINDOW#_#name=windowssize;RES#_#ftype=flags#_#name=TCP Flags;URGP}

      9. FreeBSD userlog:
        {date:Date,yyyy-MM-dd HH:mm:ss} [{text:UserActor,ftype=username}:{text:Action,ftype=eventName}] {text:ObjectName,ftype=object}({number:ID,ftype=id}){regexp:Home_Directory,ftype=homedir;refName=Message,( home\s|&\u003A)[XPLG_PARAM([^\s\u003A]*)]}{regexp:Shell,ftype=shell;refName=Message,:(/bin[^\s].*)}{string:Message,ftype=message}








               Â