How to log user query?

[Jin (Myeongjin Kim)]

Hello.
Recently, unknown user searched some query, Graylog system went down(all input, output, process buffer was full and I think it is due to heavy query) .
So, I want to figure out which query invoke this error.

To figure out, I want to log who executed a query in every search.
I found “user activity log” but it doesn’t write which query user send.
Is Enterprise audit feature can do that? is there any photo?

And also, I found views/search/{id} api and I think I could find id in access log and use api to figure out owner and query_string but even I have admin role, api returned 403 error with "user xxx no permission to load search {id}}.
Is there any way to log user’s query?

Thanks

[gsmith]

Hello,

Maybe I can help answer your question.

@Jin

To figure out, I want to log who executed a query in every search.
I found “user activity log” but it doesn’t write which query user send.

For tracking users activities, The Enterprise version might be able to handle this.Unfortunately, I do not use Enterprise version so I’m not completely sure.

https://docs.graylog.org/en/4.0/pages/auditlog/usage.html

In my environment I had to do a work around for user activities as follow.
I’m using Graylog 4.0.6 with NXlog shipper.

https://docs.graylog.org/en/4.0/pages/secure/sec_log_user_activity.html#logging-user-activity

I had to configure NXLog to read restaccess.log file.

Once that was done, I create an extractor Graylog Input called “graylog_gui” and then created a widget from that field.

Graylog Version 3.3.x displays the full name of the users, Example I’ll use my name as shown in bold print.

2021-04-09 22:23:44,520 DEBUG: org.graylog2.rest.accesslog – 10.10.10.10 greg.smith [-] “GET api/system/cluster/nodes” Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 200 -1

As of Graylog version 4.0.6 users are displayed as a GUID as shown in bold print.

2021-04-09 22:23:44,520 DEBUG: org.graylog2.rest.accesslog – 10.10.10.10 5e224e7683d72eff75055199 [-] “GET api/system/cluster/nodes” Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 200 -1

I had to create a pipeline to turn the sting 5e224e7683d72eff75055199 → greg.smith as shown below.

rule "Graylog Web Access Greg"
when
    has_field("graylog_gui") AND contains(to_string($message.graylog_gui), "5e224e7683d72eff75055199")
then
    set_field("graylog_gui","greg.smith");
end

@Jin

To figure out, I want to log who executed a query in every search

I havent doent that before, maybe someone else has.
Hope this helps