108 lines
3.9 KiB
Plaintext
108 lines
3.9 KiB
Plaintext
<!-- Configuration centralisée distribuée aux agents Wazuh -->
|
|
<!-- Déposée dans /var/ossec/etc/shared/default/agent.conf sur le manager -->
|
|
|
|
<agent_config>
|
|
|
|
<!-- ── Logs nginx ──────────────────────────────────────────────────── -->
|
|
<localfile>
|
|
<log_format>apache</log_format>
|
|
<location>/var/log/nginx/access.log</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/nginx/error.log</location>
|
|
</localfile>
|
|
|
|
<!-- ── Auth system ───────────────────────────────────────────────── -->
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/auth.log</location>
|
|
</localfile>
|
|
|
|
<!-- ── Syslog ────────────────────────────────────────────────────── -->
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/syslog</location>
|
|
</localfile>
|
|
|
|
<!-- ── Unattended-upgrades (patchs de sécurité auto) ───────────────── -->
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/unattended-upgrades/unattended-upgrades.log</location>
|
|
</localfile>
|
|
|
|
<!-- ── auditd (regles CIS 6.2.3.x deployees via ansible/hardening) ─── -->
|
|
<localfile>
|
|
<log_format>audit</log_format>
|
|
<location>/var/log/audit/audit.log</location>
|
|
</localfile>
|
|
|
|
</agent_config>
|
|
|
|
<!-- ── Logs backend Go (prod-mln) ────────────────────────────────── -->
|
|
<!-- "command" (pas full_command) = chaque ligne de docker logs → event séparé -->
|
|
<!-- Chaque ligne [GIN] devient son propre event → decoder peut extraire srcip/url/status -->
|
|
<agent_config name="prod-mln">
|
|
<localfile>
|
|
<log_format>command</log_format>
|
|
<command>docker logs --since 65s gestion-backend 2>&1</command>
|
|
<alias>backend</alias>
|
|
<frequency>60</frequency>
|
|
</localfile>
|
|
|
|
<!-- ── Logs WAF (nginx+ModSecurity/CRS, conteneur gestion-waf) ──── -->
|
|
<!-- nginx du conteneur ecrit dans des fichiers (pas stdout) -> docker logs ne capte rien. -->
|
|
<!-- Ces fichiers sont montes sur l'hote (/var/log/waf/*), on les lit directement. -->
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/waf/nginx/access.log</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/waf/nginx/error.log</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>json</log_format>
|
|
<location>/var/log/waf/modsec/modsec_audit.log</location>
|
|
</localfile>
|
|
</agent_config>
|
|
|
|
<!-- ── Logs backend Go (pre-prod-mln) ───────────────────────────── -->
|
|
<agent_config name="pre-prod-mln">
|
|
<localfile>
|
|
<log_format>command</log_format>
|
|
<command>docker logs --since 65s gestion-backend 2>&1</command>
|
|
<alias>backend</alias>
|
|
<frequency>60</frequency>
|
|
</localfile>
|
|
</agent_config>
|
|
|
|
<!-- ── Logs WAF (nginx+ModSecurity/CRS, conteneur gestion-waf) — replica-prod-uber ── -->
|
|
<agent_config name="replica-prod-uber">
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/waf/nginx/access.log</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/waf/nginx/error.log</location>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>json</log_format>
|
|
<location>/var/log/waf/modsec/modsec_audit.log</location>
|
|
</localfile>
|
|
</agent_config>
|
|
|
|
<!-- ── Logs HAProxy (load-balancer, /var/log/haproxy.log via rsyslog local0) ── -->
|
|
<agent_config name="load-balancer">
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/log/haproxy.log</location>
|
|
</localfile>
|
|
</agent_config>
|