AD Auditing with raw edition

CRT · July 10, 2023, 6:53am

Hello,

we are in a transition process to switch from zabbix 5.0.8 to checkmk 2.2.0p4 (raw). I want to audit the security event log on the domain controllers. Especially certain Event IDs like 4720, 4738, 4625 and so on. When an event log has a new entry with event ID 4720 I want a message on the website.

At the moment we don’t have the agent bakery so I’m using the config-files. Can somebody give a hint, how do I solve this case? Do I have to use the context parameter?

Best wishes from germany.

ricardoftribeiro · July 10, 2023, 9:23am

Hi @CRT , welcome to the forum.

Try to read this :

The Event Console - Processing logs and SNMP traps…#logwatch

Cheers!

Norm · July 10, 2023, 10:39am

Hi @CRT,

and welcome to the community!

You can use the event console to forward your logs and filter them with event console rule packs or you just use logwatch. Another way is to build something on your own or use this localcheck from the community to get the desired result.

To do the finetuning for the logwatch you can write your own finetune config. Here is the example config:

github.com

Checkmk/checkmk/blob/76e45d93c00612e139cc58fe1016258be56cfe55/agents/cfg_examples/logwatch.cfg

# Copyright (C) 2019 Checkmk GmbH - License: GNU General Public License v2
# This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
# conditions defined in the file COPYING, which is part of this source code package.

# logwatch.cfg
# This file configures mk_logwatch. Define your logfiles
# and patterns to be looked for here.

# Name one or more logfiles, and the options to be applied (if any)
"/var/log/messages" maxlinesize=1024 encoding=utf-8
# Patterns are indented with one space are prefixed with:
# C: Critical messages
# W: Warning messages
# I: ignore these lines (OK)
# R: Rewrite the output previous match. You can use \1, \2 etc. for
#    refer to groups (.*) of this match
# The first match decides. Lines that do not match any pattern
# are ignored
 C Fail event detected on md device
 I mdadm.*: Rebuild.*event detected

This file has been truncated. show original

Hope this helps.

Norm

CRT · July 11, 2023, 7:14am

Thank you for your replies.

I got the event console working. The rules for auto-close some event IDs are working properly. But the event IDs I want to monitor aren’t going to work. I can’t see anything in the event console when an user account was changed for example. The corresponding event ID 4738 isn’t visible in event console. In event viewer on the domain controller I can see the entry, but not on checkmk.

In the check_mk.user-file my entry looks like this:

- 'Security': all nocontext

That should be fine in my opionion. The connection to the agent is also working properly.

I keep the power shell script in mind. I think the better way of understanding checkmk is to use the out-of-the-box tools.