Viewing logs generated by OSSEC
The external event logs that the SES Evolution analysis engine generates can be read like other SES Evolution logs in the administration console and on the agent. They are visible only to host administrators on the agent. For more information, refer to Viewing and managing agent logs in the administration console and Viewing logs in the agents’ interface.
The logs contain all the fields collected during OSSEC decoding.
The severity of the log depends on the level of the OSSEC rule that specified the log:
Log level in the OSSEC rule | SES Evolution log severity |
---|---|
0 | No log |
1 | Diagnosis |
2 | Information |
3, 4, 5 | Notice |
6, 7, 8 and 9 | Warning |
10 | Error |
11, 12 | Critical |
13, 14 | Alert |
15 | Emergency |
EXAMPLE
The image below shows Filezilla logs extracted by the analysis engine and reported in the agent's interface. It detects password-based authentication attempts on a FileZilla server from the same IP address, and raises alarms when there are multiple failures followed by a successful authentication.