Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Truncated alerts #473

Open
calve opened this issue Dec 29, 2014 · 4 comments
Open

Truncated alerts #473

calve opened this issue Dec 29, 2014 · 4 comments
Labels
enhancement

Comments

@calve
Copy link
Contributor

calve commented Dec 29, 2014

Hi.

I have some alerts witch gets truncated like so :

ossec: output: 'netstat -tanp |grep LISTEN |grep -v 127.0.0.1 | sort | sed -e 's/ [0-9]*\///'':
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     sshd
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     master
tcp        0      0 0.0.0.0:4505            0.0.0.0:*               LISTEN     python
tcp        0      0 0.0.0.0:4506            0.0.0.0:*               LISTEN     python
tcp6       0      0 :::22                   :::*                    LISTEN     sshd
tcp6       0      0 :::25                   :::*                    LISTEN     master
tcp6       0      0 :::80                   :::*                    LISTEN     apache2
tcp6       0      0 :::9000                 :::*                    LISTEN     java
tcp6       0      0 :::9200                 :::*                    LISTEN     java
tcp6       0      0 :::9300                 :::*                    LISTEN     java
tcp6       0      0 :::9301                 :::*                    LISTEN     java
Previous output:
ossec: output: 'netstat -tanp |grep LISTEN |grep -v 127.0.0.1 | sort | sed -e 's/ [0-9]*\///'':
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     sshd
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     smtpd
tcp        0      0 0.0.0.0:4505            0.0.0.0:*               LISTEN     python
tcp        0      0 0.0.0.0:4506            0.0.0.0:*               LISTEN     python
tcp6       0      0 :::22                   :::*                    LISTEN     sshd
tcp6       0      0 :::25                   :::*                    LISTEN     smtpd

Witch count for 1236 char.
So Previous output sections gets truncated by an hard-coded limit in src/analysisd/alerts/log.c at line 196

    printf(
           "** Alert %d.%ld:%s - %s\n"
            "%d %s %02d %s %s%s%s\nRule: %d (level %d) -> '%s'"
            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n%.1256s\n",
            lf->time,
            __crt_ftell,
            lf->generated_rule->alert_opts & DO_MAILALERT?" mail ":"",
            lf->generated_rule->group,
            …)

What prevent us to apply this patch and rise the 1256 limit of the printf ?
@calve calve changed the title Alerts truncated Truncated alerts Dec 29, 2014
@jrossi
Copy link
Member

jrossi commented Jan 5, 2015

@calve Nothing other time no one has picked up the work and done it. Please do so it should be a simple pull request and would be accepted quickly (my guess). If you need a hand with anything let us know.

@ChristianBeer
Copy link
Contributor

See #455 for another possible solution. Raising the limit is not ideal because to what limit should we raise it and is this sufficient in the future? The mail alert should only give a first overview from where the admin can start digging into the log files.

@axot
Copy link

axot commented Mar 29, 2016

We are considering to use the following command

netstat -46ln | awk '{print substr($0,0,6), substr($0,20,48)}' | gzip -n -9 | base64

@calve
Copy link
Contributor Author

calve commented Apr 20, 2016

Quoting http://marc.info/?l=ossec-dev&m=134550679026814&w=2

The content of alerts.log may be forwarded to syslog server where there may
be size limitation.
We need to be careful here.

But it looks like syslog output is done in src/os_csyslogd/alert.c, so unsetting the length limit in analysisd should not have impact. Correct ?

@joaopsys joaopsys mentioned this issue Jul 8, 2017
Closed
@cm405d cm405d mentioned this issue Aug 2, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@jrossi @axot @ChristianBeer @calve