Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!
1. Describe your incident:
Hello I am a new user to graylog and I’d like to ask for help with a configuration. I am using winlogbeat to collect windows logon/logoff messages from computers. Every logon session has it’s specific LogonID. I need to create an event when a user doesn’t logoff after 12 hours.
What I was able to do:
Create a pipeline with a rules which adds new field in message, for Logon - Sessionidlogon and for Logoff - sessionid and then i routed these session messages to a new stream so that it would be easier to work with.
Here is the pipeline:
Stage 1 first rule:
rule “Create field SessionID”
when
has_field(“winlogbeat_winlog_task”) AND
to_string($message.winlogbeat_winlog_task) == “Logoff”
then set_field(“Sessionid”, $message.winlogbeat_winlog_event_data_TargetLogonId);
end
Stage 1 second rule:
rule “Create field SessionIDLogon”
when
has_field(“winlogbeat_winlog_task”) AND
to_string($message.winlogbeat_winlog_task) == “Logon”
then set_field(“Sessionidlogon”, $message.winlogbeat_winlog_event_data_TargetLogonId);
end
Stage 2 rule:
rule “Session stream rule”
when
has_field(“winlogbeat_winlog_task”)
then route_to_stream(“Session_stream”);
remove_from_stream(“Default Stream”);
debug($message.winlogbeat_winlog_task);
end
Till here everything works correctly, I have created a pipeline for the Session stream where I want to compare the messages and sort ended and opened sessions, so as the next step I created a rule which should sort ended session to another stream again, but I think this rule is not correct, I think it compares just fields in one message which is being processed.
The rule:
rule “Route ended session login message”
when
has_field(“winlogbeat_winlog_task”) AND
to_string($message.winlogbeat_winlog_task) == “Logon” AND
to_string($message.Sessionidlogon) == to_string($message.Sessionid)
then route_to_stream(“Ended sessions”);
end
I’ll be really grateful for any help. I haven’t figured out how to check the time of the session yet, but at first I need to know how to compare logon and logoff messages so I can sort opened and ended sessions
2. Describe your environment:
-
OS Information: Ubuntu 20.04.6 LTS
-
Package Version: Graylog 5.0.7+7758557
-
Service logs, configurations, and environment variables:
rule “Create field SessionIDLogon”
when
has_field(“winlogbeat_winlog_task”) AND
to_string($message.winlogbeat_winlog_task) == “Logon”
then set_field(“Sessionidlogon”, $message.winlogbeat_winlog_event_data_TargetLogonId);
end
Stage 2 rule:
rule “Session stream rule”
when
has_field(“winlogbeat_winlog_task”)
then route_to_stream(“Session_stream”);
remove_from_stream(“Default Stream”);
debug($message.winlogbeat_winlog_task);
end
rule “Route ended session login message”
when
has_field(“winlogbeat_winlog_task”) AND
to_string($message.winlogbeat_winlog_task) == “Logon” AND
to_string($message.Sessionidlogon) == to_string($message.Sessionid)
then route_to_stream(“Ended sessions”);
end
3. What steps have you already taken to try and solve the problem?
I was thinking about using filter and agreggation or event correlation, but I don’t think it’s usable in this situation, because I need to check if the session already ended or not.
4. How can the community help?
It would be great if someone could point me in the right direction on how to solve this.
Thank you very much.