Objective: Forward logs from all servers to OSSIM, correctly formatted and readable.
- Deploying one NXlog Collector/proxy node in each network zone - DONE
- Deploying one NXlog Collector/master node in management zone - DONE
- Deploying one Alien Vault OSSIM in management zone - DONE
As I don't want to allow all servers to send logs outside their security zone, all logs must be forwarded to a local NXlog proxy, which forwards them on to the management zone log collection system(s).
Desired outcome: Server logs (syslog and specific application logs) must be forwarded to NXlog proxy > NXlog master > OSSIM and maintain all info distinguishable as coming from the individual server.
All NXlog instances are up and running, as is the OSSIM. Data is coming in to OSSIM but opening a single event under 'Analysis / Security events' shows insufficient detail - the only useful part is the Raw log field, which may display entries like
Feb 7 10:01:01 nxlog-collector run-parts(/etc/cron.hourly)[7695 finished 0anacron
This indicates to me that somewhere in the chain there has to be some additional handling going on. Testing on a Graylog server, I was able to get better results but alas: I'm required to use Alien Vault OSSIM (open source edition).