Add information about eventlog in API report

[JcabreraC]

Related issue
#6565

This PR aims to add the location parameter of the localfile (channel) to the API responses, when querying the Logcollector's localfiles configuration. These changes only affect the localfiles that have eventchannel or eventlog formats.

Eventlog

Given the following configuration:

<localfile>
	<location>Application</location>
	<log_format>eventlog</log_format>
</localfile>

<localfile>
	<location>Security</location>
	<log_format>eventlog</log_format>
</localfile>

<localfile>
	<location>System</location>
	<log_format>eventlog</log_format>
</localfile>

<localfile>
	<location>active-response\active-responses.log</location>
	<log_format>syslog</log_format>
</localfile>

Then, querying the logcollector API' socket, the following response is obtained:

socket	query
/var/ossec/queue/sockets/request	030 logcollector getconfig localfile

Response: ok
{
    "localfile":
     [{
          "channel":"Application",
          "logformat":"eventlog",
          "ignore_binaries":"no",
          "only-future-events":"yes",
          "target":["agent"]
     },
     {
          "channel":"Security",
          "logformat":"eventlog",
          "ignore_binaries":"no",
          "only-future-events":"yes",
          "target":["agent"]
     },
     {
          "channel":"System",
          "logformat":"eventlog",
          "ignore_binaries":"no",
          "only-future-events":"yes",
          "target":["agent"]
     },
     {
          "file":"active-response\\active-responses.log",
          "logformat":"syslog",
          "ignore_binaries":"no",
          "only-future-events":"yes",
          "target":["agent"]
     }]
}

Eventchannel

Given the following configuration:

<localfile>
	<location>Application</location>
	<log_format>eventchannel</log_format>
</localfile>

<localfile>
	<location>Security</location>
	<log_format>eventchannel</log_format>
	<query>Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and
	EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and
	EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and
	EventID != 5152 and EventID != 5157]</query>
</localfile>

<localfile>
	<location>System</location>
	<log_format>eventchannel</log_format>
</localfile>

Then, querying the logcollector API' socket, the following response is obtained:

socket	query
/var/ossec/queue/sockets/request	002 logcollector getconfig localfile

Response: ok {
    "localfile": [
        {
            "channel": "Application",
            "logformat": "eventchannel",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ],
            "reconnect_time": 5
        },
        {
            "channel": "Security",
            "logformat": "eventchannel",
            "query": "Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and\n      EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and\n      EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and\n      EventID != 5152 and EventID != 5157]",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ],
            "reconnect_time": 5
        },
        {
            "channel": "System",
            "logformat": "eventchannel",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ],
            "reconnect_time": 5
        },
        {
            "file": "active-response\\active-responses.log",
            "logformat": "syslog",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ]
        }
    ]
}

Tests

• Compilation without warnings in every supported platform
  • Linux
  • Windows
  • MAC OS X
• Source installation
• Package installation
• Source upgrade
• Package upgrade
• Review logs syntax and correct language
• QA templates contemplate the added capabilities

• Memory tests for Linux
  • Scan-build report (Download)
  • Coverity
  • Valgrind (memcheck and descriptor leaks check)
  • Dr. Memory
  • AddressSanitizer
• Memory tests for Windows
  • Scan-build report (Download report)
  • Coverity
  • Dr. Memory
• Memory tests for macOS
  • Scan-build report
  • Leaks
  • AddressSanitizer

• Retrocompatibility with older Wazuh versions
• Working on cluster environments
• Configuration on demand reports new parameters
• The data flow works as expected (agent-manager-api-app)
• Added unit tests (for new features)
• Stress test for affected components

[nmkoremblum]

Just checked again the feature, with the last fixes, and obtained the following outputs:

Windows Server 2016

{
  "localfile": [
    {
      "channel": "Application",
      "logformat": "eventchannel",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ],
      "reconnect_time": 5
    },
    {
      "channel": "Security",
      "logformat": "eventchannel",
      "query": "Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and\n      EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and\n      EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and\n      EventID != 5152 and EventID != 5157]",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ],
      "reconnect_time": 5
    },
    {
      "channel": "System",
      "logformat": "eventchannel",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ],
      "reconnect_time": 5
    },
    {
      "file": "active-response\\active-responses.log",
      "logformat": "syslog",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ]
    }
  ]
}

Windows XP

{
  "localfile": [
    {
      "channel": "Application",
      "logformat": "eventlog",
      "ignore_binaries": "no",
      "target": [
        "agent"
      ]
    },
    {
      "channel": "Security",
      "logformat": "eventlog",
      "ignore_binaries": "no",
      "target": [
        "agent"
      ]
    },
    {
      "channel": "System",
      "logformat": "eventlog",
      "ignore_binaries": "no",
      "target": [
        "agent"
      ]
    },
    {
      "file": "active-response\\active-responses.log",
      "logformat": "syslog",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ]
    }
  ]
}

LGTM :)

[juliancnn]

W10 - default config:

Response: ok {
    "localfile": [
        {
            "channel": "Application",
            "logformat": "eventchannel",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ],
            "reconnect_time": 5
        },
        {
            "channel": "Security",
            "logformat": "eventchannel",
            "query": "Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and\n      EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and\n      EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and\n      EventID != 5152 and EventID != 5157]",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ],
            "reconnect_time": 5
        },
        {
            "channel": "System",
            "logformat": "eventchannel",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ],
            "reconnect_time": 5
        },
        {
            "file": "active-response\\active-responses.log",
            "logformat": "syslog",
            "ignore_binaries": "no",
            "only-future-events": "yes",
            "target": [
                "agent"
            ]
        }
    ]
}

[JcabreraC]

Windows Server

{
  "localfile": [
    {
      "channel": "Application",
      "logformat": "eventchannel",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ],
      "reconnect_time": 5
    },
    {
      "channel": "Security",
      "logformat": "eventchannel",
      "query": "Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and\n      EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and\n      EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and\n      EventID != 5152 and EventID != 5157]",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ],
      "reconnect_time": 5
    },
    {
      "channel": "System",
      "logformat": "eventchannel",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ],
      "reconnect_time": 5
    },
    {
      "file": "active-response\\active-responses.log",
      "logformat": "syslog",
      "ignore_binaries": "no",
      "only-future-events": "yes",
      "target": [
        "agent"
      ]
    }
  ]
}

LGTM !

[JcabreraC]

LGTM !