No kern.log, auth.log, mail.log in default localfile config for Debian family

[lapwingcloud]

When I use the wazuh-puppet module in Ubuntu 18.04, the default localfile config

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/syslog</location>
</localfile>
<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/dpkg.log</location>
</localfile>
<localfile>
  <log_format>syslog</log_format>
  <location>/var/ossec/logs/active-responses.log</location>
</localfile>

<localfile>
  <log_format>command</log_format>
  <command>df -P</command>
  <frequency>360</frequency>
</localfile>
<localfile>
  <log_format>full_command</log_format>
  <command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
  <alias>netstat listening ports</alias>
  <frequency>360</frequency>
</localfile>
<localfile>
  <log_format>full_command</log_format>
  <command>last -n 20</command>
  <frequency>360</frequency>
</localfile>

Which comes from manifests/params_manager.pp#L317

However kern.log auth.log mail.log did exist in Redhat default local files manifests/params_manager.pp#L375 and they used to exist in Debian default local files manifests/params.pp#L51

Also note that if I just sudo apt-get install wazuh-manager, the default config includes kern.log auth.log as well.

I think some rules rely on these log files, i.e. without these localfile configs these rules will never be triggered, right? For example

• 0030-postfix_rules.xml
• 0095-sshd_rules.xml

So what's the rationale behind removing these defaults?
Or they were removed by accident?

[rshad]

Hi @jchenrev!

Thank you for your review. This way Wazuh gets improved by our community contributions.

I'll be comparing the list of the files included in wazuh-puppet configuration and the latest default config. from wazuh-manager and wazuh-agent.

Kr,

Rshad

[rshad]

Hi @jchenrev

The missing paths were added in 5bde8e3.

Kr,

Rshad