Wazuh Log Collection and Transmission: Complete Architecture Guide#

1
<ossec_config>
2
  <localfile>
3
    <log_format>syslog</log_format>
4
    <location>/var/log/auth.log</location>
5
  </localfile>
6

7
  <localfile>
8
    <log_format>apache</log_format>
9
    <location>/var/log/apache2/access.log</location>
10
  </localfile>
11
</ossec_config>

1
<ossec_config>
2
  <remote>
3
    <connection>syslog</connection>
4
    <port>514</port>
5
    <protocol>udp</protocol>
6
    <allowed-ips>192.168.1.0/24</allowed-ips>
7
  </remote>
8
</ossec_config>

1
// Simplified C code representation of log preprocessing
2
typedef struct {
3
    char *raw_log;
4
    char *source;
5
    time_t timestamp;
6
    char *hostname;
7
    int severity;
8
    char *parsed_fields[MAX_FIELDS];
9
} log_entry_t;
10

11
int preprocess_log(log_entry_t *entry) {
12
    // Extract timestamp
13
    parse_timestamp(entry->raw_log, &entry->timestamp);
14

15
    // Extract hostname
16
    extract_hostname(entry->raw_log, entry->hostname);
17

18
    // Parse structured fields
19
    parse_fields(entry->raw_log, entry->parsed_fields);
20

21
    // Validate and sanitize
22
    return validate_log_entry(entry);
23
}

1
#include <zlib.h>
2

3
typedef struct {
4
    unsigned char *data;
5
    size_t size;
6
    size_t compressed_size;
7
    int compression_level;
8
} compression_buffer_t;
9

10
// Compression function using zlib
11
int compress_log_data(const char *input, size_t input_size,
12
                      char *output, size_t *output_size) {
13

14
    uLongf compressed_size = *output_size;
15
    int result = compress2((Bytef *)output, &compressed_size,
16
                          (const Bytef *)input, input_size,
17
                          Z_DEFAULT_COMPRESSION);
18

19
    if (result == Z_OK) {
20
        *output_size = compressed_size;
21
        return 0; // Success
22
    }
23

24
    return -1; // Error
25
}
26

27
// Example usage in agent
28
void send_compressed_log(const char* log_message) {
29
    char compressed_data[MAX_COMPRESSED_SIZE];
30
    size_t compressed_size = sizeof(compressed_data);
31

32
    if (compress_log_data(log_message, strlen(log_message),
33
                         compressed_data, &compressed_size) == 0) {
34

35
        // Add compression header
36
        compression_header_t header = {
37
            .magic = COMPRESSION_MAGIC,
38
            .algorithm = ZLIB_COMPRESSION,
39
            .original_size = strlen(log_message),
40
            .compressed_size = compressed_size
41
        };
42

43
        // Send header + compressed data
44
        send_secure_data(&header, sizeof(header));
45
        send_secure_data(compressed_data, compressed_size);
46
    }
47
}

1
#include <openssl/ssl.h>
2
#include <openssl/err.h>
3

4
typedef struct {
5
    SSL_CTX *ctx;
6
    SSL *ssl;
7
    int socket_fd;
8
    char *server_cert;
9
    char *client_cert;
10
    char *client_key;
11
} secure_connection_t;
12

13
// Establish secure connection to manager
14
secure_connection_t* establish_secure_connection(const char *server_address, int port) {
15
    secure_connection_t *conn = malloc(sizeof(secure_connection_t));
16

17
    // Initialize SSL context
18
    conn->ctx = SSL_CTX_new(TLSv1_2_client_method());
19

20
    // Load certificates
21
    SSL_CTX_use_certificate_file(conn->ctx, conn->client_cert, SSL_FILETYPE_PEM);
22
    SSL_CTX_use_PrivateKey_file(conn->ctx, conn->client_key, SSL_FILETYPE_PEM);
23

24
    // Create socket and connect
25
    conn->socket_fd = create_socket_connection(server_address, port);
26

27
    // Create SSL connection
28
    conn->ssl = SSL_new(conn->ctx);
29
    SSL_set_fd(conn->ssl, conn->socket_fd);
30

31
    if (SSL_connect(conn->ssl) != 1) {
32
        // Handle connection error
33
        cleanup_connection(conn);
34
        return NULL;
35
    }
36

37
    return conn;
38
}
39

40
// Send encrypted log data
41
int send_encrypted_log(secure_connection_t *conn, const void *data, size_t size) {
42
    return SSL_write(conn->ssl, data, size);
43
}

1
typedef struct {
2
    secure_connection_t *primary;
3
    secure_connection_t *secondary;
4
    secure_connection_t *backup;
5
    int active_connection;
6
} multi_socket_manager_t;
7

8
int send_with_failover(multi_socket_manager_t *manager, const void *data, size_t size) {
9
    secure_connection_t *connections[] = {
10
        manager->primary,
11
        manager->secondary,
12
        manager->backup
13
    };
14

15
    for (int i = 0; i < 3; i++) {
16
        if (connections[i] && send_encrypted_log(connections[i], data, size) > 0) {
17
            manager->active_connection = i;
18
            return 1; // Success
19
        }
20
    }
21

22
    return 0; // All connections failed
23
}

1
#include <pthread.h>
2

3
typedef struct {
4
    int port;
5
    SSL_CTX *ssl_ctx;
6
    pthread_t listener_thread;
7
    agent_pool_t *agent_pool;
8
} network_listener_t;
9

10
void* connection_handler(void *arg) {
11
    connection_context_t *ctx = (connection_context_t *)arg;
12

13
    char buffer[MAX_BUFFER_SIZE];
14
    int bytes_received;
15

16
    while ((bytes_received = SSL_read(ctx->ssl, buffer, sizeof(buffer))) > 0) {
17
        // Process received data
18
        process_agent_data(ctx->agent_id, buffer, bytes_received);
19
    }
20

21
    cleanup_connection(ctx);
22
    return NULL;
23
}
24

25
// Main listener function
26
void start_network_listener(network_listener_t *listener) {
27
    int server_socket = create_server_socket(listener->port);
28

29
    while (1) {
30
        int client_socket = accept(server_socket, NULL, NULL);
31

32
        // Create SSL connection
33
        SSL *ssl = SSL_new(listener->ssl_ctx);
34
        SSL_set_fd(ssl, client_socket);
35

36
        if (SSL_accept(ssl) == 1) {
37
            // Authenticate agent
38
            char agent_id[MAX_AGENT_ID];
39
            if (authenticate_agent(ssl, agent_id)) {
40
                // Create connection context
41
                connection_context_t *ctx = create_connection_context(ssl, agent_id);
42

43
                // Spawn handler thread
44
                pthread_create(&ctx->thread, NULL, connection_handler, ctx);
45
            }
46
        }
47
    }
48
}

1
// Decompression function using zlib
2
int decompress_log_data(const char *input, size_t input_size,
3
                       char *output, size_t *output_size) {
4

5
    uLongf decompressed_size = *output_size;
6
    int result = uncompress((Bytef *)output, &decompressed_size,
7
                           (const Bytef *)input, input_size);
8

9
    if (result == Z_OK) {
10
        *output_size = decompressed_size;
11
        return 0; // Success
12
    }
13

14
    return -1; // Error
15
}
16

17
// Process incoming agent data
18
void process_agent_data(const char *agent_id, const char *data, size_t size) {
19
    // Check if data is compressed
20
    compression_header_t *header = (compression_header_t *)data;
21

22
    if (header->magic == COMPRESSION_MAGIC) {
23
        // Decompress data
24
        char *decompressed_data = malloc(header->original_size);
25
        size_t decompressed_size = header->original_size;
26

27
        if (decompress_log_data(data + sizeof(compression_header_t),
28
                               header->compressed_size,
29
                               decompressed_data,
30
                               &decompressed_size) == 0) {
31

32
            // Parse decompressed log
33
            parse_and_analyze_log(agent_id, decompressed_data, decompressed_size);
34
        }
35

36
        free(decompressed_data);
37
    } else {
38
        // Process uncompressed data
39
        parse_and_analyze_log(agent_id, data, size);
40
    }
41
}

1
typedef struct {
2
    int rule_id;
3
    char *pattern;
4
    int severity;
5
    char *description;
6
    regex_t compiled_regex;
7
} analysis_rule_t;
8

9
typedef struct {
10
    analysis_rule_t *rules;
11
    int rule_count;
12
    hash_table_t *rule_cache;
13
} rules_engine_t;
14

15
// Analyze log against rules
16
alert_t* analyze_log_entry(rules_engine_t *engine, log_entry_t *log) {
17
    for (int i = 0; i < engine->rule_count; i++) {
18
        analysis_rule_t *rule = &engine->rules[i];
19

20
        if (regexec(&rule->compiled_regex, log->raw_log, 0, NULL, 0) == 0) {
21
            // Rule matched - create alert
22
            alert_t *alert = create_alert(rule, log);
23

24
            // Enrich alert with additional context
25
            enrich_alert(alert, log);
26

27
            return alert;
28
        }
29
    }
30

31
    return NULL; // No rules matched
32
}
33

34
// Main log processing function
35
void parse_and_analyze_log(const char *agent_id, const char *log_data, size_t size) {
36
    log_entry_t *log = parse_log_entry(log_data, size);
37

38
    if (log) {
39
        // Add agent context
40
        strcpy(log->agent_id, agent_id);
41

42
        // Analyze against rules
43
        alert_t *alert = analyze_log_entry(&global_rules_engine, log);
44

45
        if (alert) {
46
            // Forward alert to output modules
47
            forward_alert(alert);
48

49
            // Store in database/indexer
50
            store_alert(alert);
51
        }
52

53
        // Always store raw log for forensics
54
        store_raw_log(log);
55

56
        free_log_entry(log);
57
    }
58
}