Ingest DHCP logs using XDR collector

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Ingest DHCP logs using XDR collector

L0 Member

Hi,

 

I am having issues with ingesting DHCP log from our DCs. We are using the XDR Collector app. I suspect that the issue is with the filebeat.yml file but cannot figure out what the problem is. I have tried and followed the guide below and copy-paste the example code but no logs are showing up. The yml has been checked and the syntax is correct. 

 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-collectors/add-a...

 

Is there anyone that has successfully managed to ingest those logs? 

 

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions

Hi @bbarmanroy Thank you for your reply. The path is valid but there is something in the filebeat configuraion that is causing it to inactivate the service. I have been doing some labs on this and found out that this configuration is giving an acceptable result: 

 

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - c:\Windows\System32\dhcp\DhcpSrvLog*.log
processors:
  - add_fields:
      fields: 
        vendor: "microsoft"
        product: "dhcp"
  - drop_event.when.not.regexp.message: "^[0-9]+,.*"
  - dissect: 
      tokenizer: "%{id},%{date},%{time},%{description},%{ipAddress},%{hostName},%{macAddress},%{userName},%{transactionID},%{qResult},%{probationTime},%{correlationID},%{dhcid},%{vendorClassHex},%{vendorClassASCII},%{userClassHex},%{userClassASCII},%{relayAgentInformation},%{dnsRegError}"
 
This will store the information in dataset microsoft_dhcp_raw and the content will be split into fields defined in the tokenizer statement. 
 
Best regards,
Peter
 

View solution in original post

4 REPLIES 4

L5 Sessionator

Hi @PeterBengtslin have you checked if the path to the DHCP logs are valid? Is the issue persistent if you use a filebeat collector?

Hi @bbarmanroy Thank you for your reply. The path is valid but there is something in the filebeat configuraion that is causing it to inactivate the service. I have been doing some labs on this and found out that this configuration is giving an acceptable result: 

 

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - c:\Windows\System32\dhcp\DhcpSrvLog*.log
processors:
  - add_fields:
      fields: 
        vendor: "microsoft"
        product: "dhcp"
  - drop_event.when.not.regexp.message: "^[0-9]+,.*"
  - dissect: 
      tokenizer: "%{id},%{date},%{time},%{description},%{ipAddress},%{hostName},%{macAddress},%{userName},%{transactionID},%{qResult},%{probationTime},%{correlationID},%{dhcid},%{vendorClassHex},%{vendorClassASCII},%{userClassHex},%{userClassASCII},%{relayAgentInformation},%{dnsRegError}"
 
This will store the information in dataset microsoft_dhcp_raw and the content will be split into fields defined in the tokenizer statement. 
 
Best regards,
Peter
 

L1 Bithead

Hi, I found the problem causing service inactivation. There is a \n inserted between "tokenizer:" and its parameter that has to be removed. The result has to be on one line.

L1 Bithead

Hi Peter,

 

I had this issue with the the collector as well and thought it was the yml file also.

I thought when you install the collector it installs the file beat service with it but it dosent.

I had to go to C: > Program data>XDR Collector > Content > filebeat-windows-x86_64  run the install-service-filebeat from powershell and then start the service from powershell as well.

Once i did that it worked for me. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!