About borising

Hi @hshawn, @Sistemas_SanLucar,   I am really sorry, I totally forgot to tell you, that you needed to create some files specific for the 18.04 release.   I found the following pull request from cemasirt, which does exactly this. So, if you just create the files from the following link, in their corresponding paths, then I am sure that it works for you.   https://github.com/PaloAltoNetworks/minemeld-ansible/pull/43     PS.: Remember to use the @ otherwise I am not sure that I get an email, that you have asked me or replied to my posts 🙂 ... View more

Hi @Sistemas_SanLucar   I normally just run the playbook again.   Regards, Bo Rising ... View more

Hi @MoeJomha, @fwmike and @crimichigan,   If you follow the guide to install Minemeld on 16.04 with the use of the ansible playbook, then you can easily install Minemeld on 18.04 LTS, as I have just done.   You can find the link here: https://github.com/PaloAltoNetworks/minemeld-ansible   Best regards, Bo ... View more

Hi @michael.gabriel   That´s perfect! I was just looking at the same setup for my home lab, will try it out! Thank you for joining in with your valuable feedback, much appreciated! ... View more

Hi @michael.gabriel,   We were looking into this article: https://live.paloaltonetworks.com/t5/MineMeld-Articles/Correlating-PAN-OS-syslog-with-indicators/ta-p/72078   And thought of using graylog for the receiving end, as this was a system we already use internally, nothing more special in that 🙂   Though I am having some issues getting it to work, as there are no correlations being sent out, so haven't looked more into it the last couple of months. ... View more

Hi @JeelaniGh   I am not working for PAN, so I can't vouch for the recommendation, but at our company we have been using minemeld successfully since summer 2017, and just now starting to use minemeld together with other software stacks, like a SIEM and graylog. ... View more

Hi @lmori,   Do you think, there's a possibility that I can troubleshoot this someway myself?   Regards, Bo ... View more

Hi @lmori   My minemeld updated a couple of hours ago to 0.9.42 (good work with the backup!), but I still can't see any indicators in the syslog node, even that my firewall have sent plenty of logs since the upgrade.   How could we troublehsoot this further?   Have a great day! ... View more

Hi again @lmori     I just did a debug session of when rsyslogd receives a syslog message, as I had a suspicion that it might be an issue parsing the 8.x logs.   Though I can't really get much out of it, you might 🙂     So if you think you could use the output for further debugging, then let me know.   Regards, Bo Rising ... View more

Hi @soc_enav,   Thats one great write up on how to use Minemeld! Keep it coming 🙂   Regards, Bo ... View more

Hi @lmori,   I started out with 8.0.3-h4, but have upgraded to 8.0.4 along the way.   Regards, Bo ... View more

Hi @lmori,   Then I'll just wait, and update this message, when I have tested further 🙂   Regards, Bo ... View more

Hi @lmori,   When do you think the next release will be available?   Regards, Bo ... View more

Hi @lmori,   Any luck of finding out what causes this problem?   Thanks! ... View more

Here you go:   xxx@minemeld01:~$ sudo rabbitmqctl list_queues | grep -i syslog localSyslog:rpc 0 mbus:directslave:localSyslog:rpc 0 mbus:slave:localSyslog:rpc 0 xxx@minemeld01:~$ ... View more

Hi Luigi,   There are only 2 rsyslog.log files, which I have cat'ed below. Rsyslogd is running, as you can see. xxx@minemeld01:/var/log$ cat rsyslog.log xxx@minemeld01:/var/log$ cat rsyslog.log.1 Jul 2 21:44:32 minemeld01 rsyslogd: [origin software="rsyslogd" swVersion="8.17.0" x-pid="5101" x-info="http://www.rsyslog.com"] start Jul 2 21:44:32 minemeld01 rsyslogd: rsyslogd's groupid changed to 104 Jul 2 21:44:32 minemeld01 rsyslogd: rsyslogd's userid changed to 101 Jul 2 21:45:14 minemeld01 rsyslogd: [origin software="rsyslogd" swVersion="8.17.0" x-pid="5101" x-info="http://www.rsyslog.com"] exiting on signal 15. Jul 2 21:45:14 minemeld01 rsyslogd: [origin software="rsyslogd" swVersion="8.17.0" x-pid="5420" x-info="http://www.rsyslog.com"] start Jul 2 21:45:14 minemeld01 rsyslogd: rsyslogd's groupid changed to 104 Jul 2 21:45:14 minemeld01 rsyslogd: rsyslogd's userid changed to 101 Jul 4 06:53:12 minemeld01 rsyslogd: [origin software="rsyslogd" swVersion="8.17.0" x-pid="5420" x-info="http://www.rsyslog.com"] rsyslogd was HUPed xxx@minemeld01:/var/log$ ps xau | grep rsyslogd xxx 430 0.0 0.1 11764 1960 pts/1 S+ 17:08 0:00 grep --color=auto rsyslogd syslog 5420 0.0 0.0 378196 708 ? Ssl Jul02 0:03 rsyslogd And the rsyslog version: xxx@minemeld01:/var/log$ dpkg -l | grep rsyslog ii rsyslog 8.17.0-0adiscon2trusty1 amd64 a rocket-fast system for log processing ii rsyslog-minemeld 8.16-0 amd64 minemeld modules for rsyslog ii rsyslog-mmnormalize 8.17.0-0adiscon2trusty1 amd64 The rsyslog-mmnormalize package provides log normalization ... View more

Hi Luigi,   I have attached the screenshot, and a screenshot of the sources tab and how it looks on the Nodes page.   Regards, Bo ... View more

Hi,   I have had disabled the dnsproxy for my appletv for the last couple of months, which worked for me.   But then after upgrading my appletv to the latest releaes yesterday evening, Netflix suddenly stopped working.   I then enabled the "allow header range option", and Netflix worked again 🙂   So thank you for the tip!   PS.: Running 8.0.3-h4. ... View more

Hi @Angelo, you have a small typo in the second path for nginx:   [minemeld ~]$ sudo mv /etc/nginx/minemeld.cer /etc/ngnix/minemeld.cer-orig [minemeld ~]$ sudo mv /etc/ngnix/minemeld.pem /etc/ngnix/minemeld.pem-orig   Should instead be:   [minemeld ~]$ sudo mv /etc/nginx/minemeld.cer /etc/nginx/minemeld.cer-orig [minemeld ~]$ sudo mv /etc/ngnix/minemeld.pem /etc/nginx/minemeld.pem-orig ... View more