Forward analysisd JSON alerts over syslog - #2302
Merged
Merged
Conversation
…ass field. JSON syslog_output tails alerts.json (on by default) instead of rebuilding a compact object from alerts.log. Default, CEF, and Splunk formats are unchanged.
Logrotate must not touch /var/ossec/logs/alerts. New json-queue files use the Atomicorp copyright, and a regression covers jsonout_output defaulting on unless the XML tag sets no.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates os_csyslogd to forward JSON syslog alerts by tailing analysisd’s alerts.json output (rather than reconstructing JSON from alerts.log), enabling inclusion of agent_name to address issue #1907. It also changes jsonout_output to default “on” when omitted, and adds build/regression checks around that behavior.
Changes:
- Add a JSON file-queue reader for
alerts.jsonand route JSON syslog output through it. - Introduce
OS_Alert_SendSyslog_JSON()to syslog-forward the fullalerts.jsonobject (with truncation stubs as needed). - Default
jsonout_outputto enabled when the XML tag is omitted, and add regression + build-test verification.
Reviewed changes
Copilot reviewed 18 out of 19 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| testsuite/README.md | Documents new optional post-build verification checks. |
| testsuite/build-test/verify-jsonout-default.sh | Adds a post-server-build check to validate jsonout default behavior. |
| testsuite/build-test/build.sh | Passes TEST through and routes Linux builds via build-linux.sh. |
| testsuite/build-test/build-linux.sh | Runs target-specific post-build verification (agent vs server/hybrid). |
| src/tests/regressions/README.md | Registers the new jsonout_default regression test. |
| src/tests/regressions/Makefile | Adds a jsonout_default regression build target. |
| src/tests/regressions/jsonout_default.c | New regression verifying jsonout_output default-on semantics and explicit yes/no behavior. |
| src/os_csyslogd/json-queue.c | New JSON tail/parse implementation for alerts.json. |
| src/headers/json-queue.h | New public header for JSON queue functions. |
| src/os_csyslogd/csyslogd.h | Exposes OS_Alert_SendSyslog_JSON() and includes cJSON.h. |
| src/os_csyslogd/csyslogd.c | Implements mixed log+JSON draining and sends JSON alerts via syslog. |
| src/os_csyslogd/alert.c | Removes legacy “rebuild JSON from alerts.log” path; adds JSON-forwarding function + stub logic. |
| src/analysisd/config.c | Changes Config.jsonout_output default from off to on. |
| install.sh | Writes <jsonout_output>yes</jsonout_output> into newly generated server configs. |
| etc/ossec.conf | Enables jsonout_output in the default config template. |
| etc/ossec-server.conf | Enables jsonout_output in the server config template. |
| etc/ossec-local.conf | Enables jsonout_output in the local config template. |
| contrib/specs/ossec-hids.logrotate | Stops rotating alerts logs here (delegates to ossec-monitord). |
| .gitignore | Ignores the new src/jsonout_default regression binary. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
149
to
159
| if (sources.alert_log && drained < JSON_DRAIN_MAX) { | ||
| tm = time(NULL); | ||
| p = localtime_r(&tm, &tm_buf); | ||
| if (p && fileq) { | ||
| /* Mixed JSON+log: one FileMon wait (5s) instead of five, so | ||
| * JSON catch-up is not delayed up to 25s. Skip the log wait | ||
| * while a JSON batch is still draining. */ | ||
| log_timeout = sources.alert_json ? 1 : 5; | ||
| al_data = Read_FileMon(fileq, p, log_timeout); | ||
| } | ||
| } |
| return -1; | ||
| } | ||
|
|
||
| if (tail && fseek(queue->fp, 0, SEEK_END) == -1) { |
Comment on lines
+366
to
+378
| rule = cJSON_GetObjectItem(json_data, "rule"); | ||
| if (rule) { | ||
| cJSON *rr = cJSON_CreateObject(); | ||
| item = cJSON_GetObjectItem(rule, "sidid"); | ||
| if (cJSON_IsNumber(item)) { | ||
| cJSON_AddNumberToObject(rr, "sidid", item->valueint); | ||
| } | ||
| item = cJSON_GetObjectItem(rule, "level"); | ||
| if (cJSON_IsNumber(item)) { | ||
| cJSON_AddNumberToObject(rr, "level", item->valueint); | ||
| } | ||
| cJSON_AddItemToObject(stub, "rule", rr); | ||
| } |
Comment on lines
+57
to
+63
| # GlobalConf lives in analysisd/config.c (defines _Config Config). | ||
| # Compile current global-config.c so jsonout_output offset matches the headers. | ||
| jsonout_default: tests/regressions/jsonout_default.c analysisd/config.c config/global-config.c config.a shared.a | ||
| $(CC) $(CFLAGS) -I./analysisd -o $@ tests/regressions/jsonout_default.c analysisd/config.c \ | ||
| config/global-config.c \ | ||
| -Wl,--start-group config.a shared.a os_regex.a os_net.a os_xml.a os_zlib.a libcJSON.a -Wl,--end-group \ | ||
| -lpcre2-8 -lm -lpthread -lz |
Comment on lines
+54
to
+57
| if (write_cfg(cfg, xml) != 0) { | ||
| failures++; | ||
| return; | ||
| } |
Signed-off-by: Scott R. Shinn <scott@atomicorp.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JSON syslog_output tails alerts.json (on by default) instead of rebuilding a compact object from alerts.log. This adds a new field for the agent name, closing issue #1907