Found file log4j?

Checkmk Exchange
263

@rprengel the option --exclude-pattern is not implemented (yet), only the --exclude, --exclude-fs, --exclude-config and --exclude-file-config options from the scanner are implemented.

264

Hallo,
means I ve to config full pathes?
Any limits known how many different paths can be configured?
Ralf

265

you can use the Exclude paths → Exclude paths (bulk) option. There should be no real limit.

From the logpresso usage:

> --exclude-config [config_file_path]
>         Specify exclude path prefix list in text file. Paths should be separated by new line. Prepend # for comment.
266

Ok,
time to check it :slight_smile:
Ralf

267

Hallo,
here can I check if the parameter
Cache time (min 600s): 600 s
is active on a client (windows).
In which file is this value written?
Ralf.

268

On windows this should be in C:\ProgramData\checkmk\agent\check_mk.user.yml see the HowTo Linux and Windows…

269

@all there is an update version of the package avalable here.

  • CHECK: added check plugin with the CVE id as item (on multiple requests of a single user @Doc :wink: )
  • BAKERY: added option –exclude-pattern to the Exclude paths section (@rprengel)
  • INVENTORY: extended report for additional log4j/logback CVEs
  • WATO:
    • added options for per CVE check
    • added discovery rule for per CVE check plugin
    • added rules for inventory plugins
    • changed display name (again) from ‘CVE scanner for log4j (CVE-2021-44228-log4j)’ to ‘log4j CVE scanner (CVE-2021-44228-log4j)’
    • enabled “Send report to checkmk” in “Enable reporting” by default for new rules
  • METRICS: added metrics/graph/perfometer for files_affected
  • How To:
    • added “Inventory plugins”, “Check plugin cve_2021_44228_log4j_cves” and “Scanner options implemented in the bakery” sections in “Use with the enterprise/free edition of CMK”
    • updated “The config file for cve_44228_log4j agent plugin”

Note: before installing the update untick the “Exclude paths” option in the agent rules and bake the agent.
After the update you can reconfigure the “Exclude paths” option.

To use the new check plugin and the CVE inventory you need to enable “Enable reporting” → “Send report to checkmk” in the bakery plugin rules. Whether a file is affected by a specific CVE and the additional information in the inventory is based solely on the log4j/logback version reported by the Logpresso scanner. It says nothing about whether the CVE is exploitable or not.

1 Like
270

yeeeehaaa

1234567890

271

Hallo,
thank you for the feature.
We will meet us in Munich.
Ralf

272

We will all meet in Munich!

273

Hallo,
is the exclude pattern option case sensitive?
Ralf

274

not testet my self, so let us know :wink:

275

Hallo,
anyone here using graphs to visual the results of the log4j checks?
I need some nice pictures for our management,
Suggestions and ideas are welcome.

Ralf

276

Hallo,
will the new version be published on
https://exchange.checkmk.com/ ?

Ralf

277

It will :wink:

@rprengel done, lets see how long it takes to go through the aproval process

278

@rprengel: Review finished, new version is online on the exchange. :tada:

1 Like
279

Thanks,
download worked.
BTW:
Thanks for the hints about the agent-configuration.
Ralf

1 Like
280

Hi all,

As this topic is getting long now, I would like to ask your opinion about creating a new one for future updates. I invite you to discuss here to keep this one on-topic. :slight_smile:

Cheers,
Faye

281

@all version 20220205.v0.1.2 is available here and on the Exchange

  • Scanner: changed to version 2.9.2
    • significant faster
    • needs less memory
    • better version detection (no more N/A or at lest a lot less)
  • Bakery/WATO:
    • added option --throttle to limit CPU usage by max. # of files to scan per second
    • added option -Xmx to limit memory usage
    • removed option --force-fix/–backup-path
  • Agent plugin:
    • added additional CVEs for Log4j 1 (CVE-2022-23307, CVE-2022-23305, CVE-2022-23302 and CVE-2019-17571)
    • added Warn/Crit based on CVSS score
    • added CVE Description/Comment to service details
    • changed defaults for WARN/CRIT of affected files form (1, 1) to (None, None)
    • fixed missing comment in CVE data (THX to doc[at]snowheaven[dot]de)
  • WATO:
    • added Monitoring state for CVE not found in agent data
    • changed options Scan for logback and Scan for log4j 1 enabled by default for new agent plugin rules
  • Inventory
    • added entry’s for CVE-2022-23307, CVE-2022-23305, CVE-2022-23302 and CVE-2019-17571

Note: before updating to this version, untick Fix files and backup option in the agent rules.

2 Likes
282

Hallo,
thanks again.
Great to see a CPU Limit.
Ralf

1 Like