rsyslogd dependencies problem

[uam]

Hi Luigi,

I was testing stdlib.localSyslog to correlate paloalto logs with indicator following this article https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/MineMeldArticles/article-id/11

But I was unable to make it work. After a while, I have noticed that rsyslogd was not running. If you run "service rsyalogd status" says that is running but it's not. After run manually i got the next error:

root@minemeld:/var/log# rsyslogd
rsyslogd: error while loading shared libraries: libfastjson.so.3: cannot open shared object file: No such file or directory

It seems that rsyslog is compiled against libfastjson3 but ubuntu 14.04 it use libfastjson4.

I'm using the VM with Ubuntu 14.04. Minemeld 0.9.26

Regards.

[lmori]

Hi @uam,

could you try downgrading to libfastjson 0.99.2-0adiscon1trusty1 ? that is the version distributed by minemeld repo.

We have plans to move to Ubuntu 16.04, there rsyslogd has been updated to 8.16 and will make our life easier.

Thanks !

luigi

[uam]

Hi Luigi,

that's was I did and rsyslogd is up&running now. 🙂

I have  configured successfully the syslog-analyzer and feed stats are now working. By the way, great feature! 

But I don't really know how to set the rules in the syslog-miner to extract indicators. I have look for any documentation but no luck. Is there any article related? I would like to create a feed with indicators from drop/deny logs from PA.

Regards.

Victor.

[lmori]

Hi @uam,

have you checked this https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-the-syslog-Miner/ta-p/77262 ?

Really far from being complete, but it should give you an idea of how things work.

Luigi