Editing Example Cartographer Agent Configuration (section)

== Example Directives ==

=== Database Connections ===

Assuming that mySQL and PostgreSQL are properly configured for sysloging, these entries will scan syslog files for database connections and create dependencies for the corresponding clients.  Cartographer agents will also scan for database connections via the TCP connection table, however, Cartographer agents may miss very short lived TCP connections.
 
<pre>
<logfileDependency>
  <logfile>/var/log/mysqld.log</logfile>
  <dependType>dependDB</dependType>
  <addExpression>Connect *(.*)@(.*) on</addExpression>
  <removeExpression></removeExpression>
  <dependClient>$2</dependClient>
  <dependServer>mankato</dependServer>
  <dependArgs>application='mysqld' user='$1'</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>3600</timeout>
</logfileDependency>

<logfileDependency>
  <logfile>/var/log/messages</logfile>
  <dependType>dependDB</dependType>
  <addExpression>postgres.*connection received: host=(.*) </addExpression>
  <removeExpression></removeExpression>
  <dependClient>$1</dependClient>
  <dependServer>onms</dependServer>
  <dependArgs>application='postgres'</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>3600</timeout>
</logfileDependency>
</pre>

=== Search for DHCP Clients ===

The ISC DHCP daemon logs clients that it assigns addresses to.  Snarfing these log entries allows Cartographer to determine DHCP clients.

<pre>
<logfileDependency>
  <logfile>/var/log/messages</logfile>
  <dependType>dependDHCP</dependType>
  <addExpression>DHCPACK on (.*) to (.*) via (.*)</addExpression>
  <removeExpression></removeExpression>
  <dependClient>$1</dependClient>
  <dependServer>127.0.0.1</dependServer>
  <dependArgs>interface='$3' macaddr='$2'</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>3600</timeout>
</logfileDependency>
</pre>

=== Search for IMAP Email User Dependencies ===

<pre>
<logfileDependency>
  <logfile>/var/log/maillog</logfile>
  <dependType>dependEmail</dependType>
  <addExpression>imap-login.*user=(.*),.*rip=(.*), lip</addExpression>
  <removeExpression></removeExpression>
  <dependClient>$2</dependClient>
  <dependServer>uncasville</dependServer>
  <dependArgs>user='$1'</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>3600</timeout>
</logfileDependency>
</pre>

=== Search for VPN Dependencies ===

<pre>
<logfileDependency>
  <logfile>/var/log/messages</logfile>
  <dependType>dependVPN</dependType>
  <addExpression>openvpn.*Peer Connection.*with (.*):(.*)</addExpression>
  <removeExpression></removeExpression>
  <dependClient>$1</dependClient>
  <dependServer>127.0.0.1</dependServer>
  <dependArgs>VPN</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>21600</timeout>
</logfileDependency>
</pre>

=== Search for DNS Slave Servers Performing Zone Transfers ===

Slave client transferring from server:
<pre>
<logfileDependency>
  <logfile>/var/log/named.log</logfile>
  <dependType>dependDNS</dependType>
  <addExpression>.*transfer of.*from (.*)#</addExpression>
  <removeExpression></removeExpression>
  <dependClient>127.0.0.1</dependClient>
  <dependServer>$1</dependServer>
  <dependArgs>zone xfer</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>21600</timeout>
</logfileDependency>
</pre>

Server side log of client transfer will detect zone transfers to slaves:
<pre>
<logfileDependency>
  <logfile>/var/named/chroot/var/log/named.log</logfile>
  <dependType>dependDNS</dependType>
  <addExpression>client (.*)#.*transfer of (.*):.*</addExpression>
  <removeExpression></removeExpression>
  <dependClient>$1</dependClient>
  <dependServer>127.0.0.1</dependServer>
  <dependArgs>zone='$2' xfer</dependArgs>
  <scanInterval>120</scanInterval>
  <timeout>21600</timeout>
</logfileDependency>
</pre>

=== Logfile Monitor for Authentication Issues ===

Logins attempts on secure server machines may warrant additional scrutiny.

<pre>
<logfileMonitor>
  <logfile>/var/log/secure</logfile>
  <expression>Accepted password for .*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/secure</logfile>
  <expression>Failed password for .*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/maillog</logfile>
  <expression>postfix.*SASL LOGIN.*fail.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

</pre>

''saslauthd'' has been known to fall over at times and this makes users unhappy.

<pre>
<logfileMonitor>
  <logfile>/var/log/messages</logfile>
  <expression>.*kernel.*saslauthd.*seg.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>
</pre>

=== Virtual Machine Guest/Host Static Dependency ===

<pre>
 <dependency>
   <dependClient>127.0.0.1</dependClient>
   <dependServer>vmhost</dependServer>
   <dependType>dependVM</dependType>
   <dependArgs></dependArgs>
   <dependReference>dependOutbound</dependReference>
 </dependency>
</pre>

=== Security and Hacking Attempts ===

The Internet is full of despicable creatures out there attempting to break into our computers.  Here are a few logfile monitoring entries to alert us to the more interesting attack avenues.  Some of the expressions and logfiles are dependent on your local configuration.

<pre>
<logfileMonitor>
  <logfile>/var/log/httpd/ssl_error_log</logfile>
  <expression>phpMyAdmin.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/httpd/ssl_request_log</logfile>
  <expression>phpMyAdmin.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/httpd/access_log</logfile>
  <expression>phpMyAdmin.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/httpd/error_log</logfile>
  <expression>phpMyAdmin.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/maillog</logfile>
  <expression>Blocked.*SPAM.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/secure</logfile>
  <expression>Failed password for .*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/messages</logfile>
  <expression>Illegal DNS output.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>

<logfileMonitor>
  <logfile>/var/log/messages</logfile>
  <expression>Illegal SMTP output.*</expression>
  <scanInterval>120</scanInterval>
</logfileMonitor>
</pre>