{"type":"doc","content":[{"type":"heading","attrs":{"level":4},"content":[{"type":"hardBreak"},{"text":"Topics Discussed","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"9e192079-b019-4d00-8248-74b5489534cd"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"7f50998a-bb7d-40a1-be36-e03da85c893c"}},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Obtain Log Relay for Remote Log Collection"},"name":{"value":"Remote Log Collection Permissions"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"c3fa194f-1073-4228-8271-7f4531ac49db"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"b04f20f1-b603-4e8c-b7c0-90ba7e98c929"}}]},{"type":"paragraph","content":[{"text":"You can use this document to send Apache logs to Armor's Security Information & Event Management (SIEM).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configure Your Apache Service","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Configuring Apache services uses the Command Line Interface (CLI) feature. For more information, see ","type":"text"},{"text":"Security Service CLI Commands","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/KB/pages/3519583035"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"The following arguments are possible parameters for the Logging CLI feature. This allows customers to manage filebeat modules on Virtual Machines.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":66.66},"content":[{"type":"table","attrs":{"layout":"wide","width":697.0,"localId":"806d854c-353b-416a-b87f-6fede89645fb"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"paragraph","content":[{"text":"Command","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph","content":[{"text":"Arguments","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Result","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-enable","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Enables filebeat IIS/apache/nginx. When run, module yml file will change from disabled state to enable state.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache- disable","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Disables Filebeat IIS/apache/nginx. When run the module yml file will change from enable state to disable mode.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-add-access-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Includes the argument paths in module yml file under the 'access_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-remove-access-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Removes the argument paths in module yml file under the 'access_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-add-error-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Includes the argument paths in module yml file under the 'error_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-remove-error-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"Removes the argument paths in module yml file under the 'error_paths' section. Removes the argument paths in module yml file under the 'error_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-sync-config","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"The command sync the module yml file on vm with latest changes which are required.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[160.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"apache-describe-config","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[102.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"The command displays current access & error paths which are configured in module yml file.","type":"text"}]}]}]}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph"}]}]},{"type":"rule"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Command Usage:","type":"text"}]},{"type":"codeBlock","content":[{"text":"armor logging apache-enable\n\narmor logging apache-disable\n\narmor logging apache-add-access-paths \n\narmor logging apache-remove-access-paths \n\narmor logging apache-add-error-paths \n\narmor logging apache-remove-error-paths \n\narmor logging apache-sync-config\n\narmor logging apache-describe-config","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Additional Information","type":"text"}]},{"type":"paragraph","content":[{"text":"Apache will need configuration for a specific log format. This is normally done in the httpd.conf file. Documentation for the log_config_module can be found at ","type":"text"},{"text":"http://httpd.apache.org/docs/current/mod/mod_log_config.html","type":"text","marks":[{"type":"link","attrs":{"href":"http://httpd.apache.org/docs/current/mod/mod_log_config.html"}}]}]},{"type":"paragraph","content":[{"text":"Configure Log Format Directive","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Apache Docs","type":"text","marks":[{"type":"link","attrs":{"href":"http://httpd.apache.org/docs/current/mod/mod_log_config.html#logformat"}}]},{"type":"hardBreak"},{"text":"Without Reverse Proxy","type":"text"}]},{"type":"codeBlock","content":[{"text":"LogFormat \"httpd: %h %A %l %u %t \\\"%r\\\" %>s %p %b \\\"%{Referer}i\\\" \\\"%{User-agent}i\\\"\" armor_noproxy_202004","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"With Reverse Proxy","type":"text"}]},{"type":"codeBlock","content":[{"text":"LogFormat \"httpd: %a %A %l %u %t \\\"%r\\\" %>s %p %b \\\"%{Referer}i\\\" \\\"%{User-agent}i\\\"\" armor_proxy_202004","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Configure Custom Log Directive","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Apache Docs","type":"text","marks":[{"type":"link","attrs":{"href":"http://httpd.apache.org/docs/current/mod/mod_log_config.html#customlog"}}]},{"type":"hardBreak"},{"text":"The filename supplied to CustomLog will need to be added as a file path with the Security Service CLI Commands.","type":"text"}]},{"type":"codeBlock","content":[{"text":"CustomLog \"logs/access_log\" armor_noproxy_202004","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Configure Custom Log Directive will create a filename that is then used with the command:","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Midnight1

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"codeBlock","content":[{"text":"armor logging apache-add-access-paths","type":"text"}]}],"version":1}}}}]},{"type":"paragraph"}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"hardBreak"},{"text":"Full Example","type":"text"}]},{"type":"codeBlock","content":[{"text":"\nLogFormat \"httpd: %a %A %l %u %t \\\"%r\\\" %>s %p %b \\\"%{Referer}i\\\" \\\"%{User-agent}i\\\"\" armor_noproxy_202004\nCustomLog \"logs/access_log\" armor_noproxy_202004\n","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"paragraph","content":[{"text":"Verify that logs are formatted correctly, similar to the following example:","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Midnight1

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"codeBlock","content":[{"text":"httpd: 192.0.2.0 192.0.2.0 - - [29/Apr/2020:12:18:03 +0000] \"GET /cmd.exe HTTP/1.0\" 404 80 196 \"-\" \"curl/7.61.1\"","type":"text"}]}],"version":1}}}}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Midnight1

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"codeBlock","content":[{"text":"httpd: 198.51.100.0 192.0.2.0 - - [29/Apr/2020:10:47:38 +0000] \"GET / HTTP/1.1\" 200 80 1580 \"-\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36\"","type":"text"}]}],"version":1}}}}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Midnight1

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"codeBlock","content":[{"text":"httpd: 203.0.113.0 192.0.2.0 - - [29/Apr/2020:13:12:58 +0000] \"GET http://example.com/ HTTP/1.1\" 200 80 1580 \"-\" \"Security Scanner\"","type":"text"}]}],"version":1}}}}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Missing Logs","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"If Apache logs locally do not match what's in Armor Log Search, verify the file size of the logs ingested. Filebeat has a maximum file size of 10MB. Anything over 10MB will require updates to the Filebeat Apache configuration, with the max-bytes property set to the desired value. ","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"Note: Running ","type":"text"},{"text":"#armor logging apache-sync-config","type":"text","marks":[{"type":"code"}]},{"text":" will overwrite the custom setting already in the configuration file.","type":"text"}]}]}],"version":1}