OSSEC is a powerful Host Intrusion Detection System (HIDS) platform with an exceptional log analysis engine. It was founded by Daniel, one of our Founders. To date, one of the platforms biggest drawbacks has always been the lack of a web interface. OSSEC users have always been forced to make use of the terminal, or one of the few enterprise GUI interfaces that have been released over the years.
The reality, however, is that what users really wanted was a simple, easy to use, platform that allowed them to easily view, parse and analyze the logs and alerts being generated by OSSEC. Trunc now solves this problem with a very easy to use GUI that focuses on three things: collection, analysis and retention. Now OSSEC users can easily aggregate all their logs into a very simple platform that focuses on those three components, removing the rest of the noise. Just focused on the logs.
Configuring OSSEC to communicate with Trunc is simple. You will make use of the client-syslog daemon. This daemon was designed to use the servers syslog capability and will forward all your alerts a central log platform.
There are four, possibly five steps, depending on your environment to getting configured your OSSEC deployment configured with Trunc:
From your terminal enable the client-syslog daemon by running this command:
/var/ossec/bin/ossec-control enable client-syslog
This command will start the ossec-csyslogd daemon.
Then, open the OSSEC config file (often at /var/ossec/etc/ossec.conf) and add the following:
$ sudo vim /var/ossec/etc/ossec.conf
You can add the following right after the initial <Global> entry:
Replace SYSLOGSERVER and SYSLOGPORT for the syslog server and port assigned to your account (you can see it here).
After modifying the configuration file, restart OSSEC:
$ sudo /var/ossec/bin/ossec-control restart
You're looking for an output that shows the daemon has started successfully. Something like this:
# /var/ossec/bin/ossec-control status
ossec-monitord is running...
ossec-logcollector is running...
ossec-remoted is running...
ossec-syscheckd is running...
ossec-analysisd is running...
ossec-maild is running...
ossec-execd is running...
ossec-csyslogd is running...
ossec-integratord is running...
Before Trunc knows what logs to collect, you must tell it where it is coming from. You do this via the Trunc dashboard, via Settings.
Add the IP in the input box where it says Add Server IP and be sure to click Allow Server.
The last, possible, update will be to verify that you are allowing your server to communicate with the Trunc servers. Here is an example of what you might need to do in IPTables.
$ sudo iptables -I INPUT -p udp -d 18.104.22.168 -j ACCEPT
$ sudo iptables -I INPUT -p udp -s 22.214.171.124 -j ACCEPT