Filebeat For Iptables Centos 7 And Iptables using UFW For Ubuntu 18.04

Filebeat For Iptables Centos 7 And Iptables using UFW For Ubuntu 18.04.txt

Filebeat For Iptables Centos 7 And Iptables using UFW For Ubuntu 18.04

1) Enable firewalld log

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/configuring_logging_for_denied_packets

firewall-cmd --get-log-denied
off

firewall-cmd --set-log-denied=all
success

firewall-cmd --get-log-denied
all

2) Add /etc/rsyslog.d/firewalld.conf

# Log kernel generated UFW log messages to file
:msg,contains,"STATE_INVALID_DROP:" /var/log/firewalld.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
& stop


3) Firewalld FileBeat module

# Module: iptables
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-iptables.html

- module: iptables
  log:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/filrewalld.log"]

================


==== Iptables using UFW For Ubuntu 18.04 

edit /etc/filebeat/modules.d/iptables.yml

# Module: iptables
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-iptables.html

- module: iptables
  log:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/ufw.log"]

=====

edit /etc/rsyslog.d/20-ufw.conf

# Log kernel generated UFW log messages to file
:msg,contains,"[UFW " /var/log/ufw.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
& stop

=

filebeat module enable iptables
systemctl restart filebeat

=

systemctl restart rsyslog

====