Accenture MDR Quick Start Guide for Apache Server

This quick start guide will help Accenture MDR customers configure Apache Server to send logs to the Log collection Platform (LCP).

The guide details standard configuration processes for the NxLog agent to send Apache logs in TCP to the LCP. Please refer to the vendor document for more information on various configuration types for each agent.

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Device configuration changes for log collection
- 3.1 Supported format for the Apache HTTP Server Access Logs
- 3.2 Configuring Apache HTTP Server Access Logs on Windows and Linux
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
Apache Server	LCP	10014 (TCP with TLS) or 10013 (TCP with NON-TLS)	Default port

Device configuration changes for log collection

Supported format for the Apache HTTP Server Access Logs

Common Log Format:

Defined in apache LogFormat by: %h %l %u %t \"%r\" %>s %b

Combined Log Format:

Defined in apache LogFormat by: %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"

Only these two Log Formats Common and Combined are supported.

Configuring Apache HTTP Server Access Logs on Windows and Linux

Windows:

By default, Apache is installed in C:\Apache24. If you are using a different directory, adjust the paths accordingly.
The main configuration file is typically located at 'C:\Apache24\conf\httpd.conf'. Open httpd.conf in a text editor
Find the section in httpd.conf where logging is configured. It should have below entries,

LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined

Ensure you have a CustomLog directive pointing to your access log file. Add or modify the line to match the common or combined log format,

CustomLog "<Log Directory>/access.log" combined

Replace <Log Directory> with actual log file path/directory.

Save httpd.conf and close the text editor.
Open command prompt as an administrator and restart the Apache service

httpd -k restart

Linux:

By default, and depending upon Linux distribution, Apache's configuration directory would be /etc/httpd or /etc/apache2. The main configuration file would be located at /etc/httpd/conf/httpd.conf or /etc/apache2/apache2.conf.
Based on Linux distribution, open httpd.conf or apache2.conf using text editor

or

Find the section in httpd.conf/apache2.conf where logging is configured. It should have below entry,

Ensure you have a CustomLog directive pointing to your access log file. Add or modify the line to match the combined log format,

Replace <Log Directory> with actual log file path/directory.

Save the configuration file

Restart the Apache service to apply the changes based on Linux distribution,

or

Log Configuration via NxLog Agent

You can select any one of the below options to send logs to the LCP.

To configure the NxLog Agent for Non-TLS TCP Log flow on Windows using port 10013
To configure the NxLog Agent for Non-TLS TCP Log flow on Linux using port 10013
To configure the NxLog Agent for TLS TCP Log flow on Linux and Windows using port 10014

Steps to configure the sever via NxLog Agent for Non-TLS TCP Log flow on Windows using port - 10013

Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download
Go to services.msc and stop the nxlog service.
Go to folder "C:\Program Files (x86)\nxlog\data" and delete "configcache.dat".
For Windows Agent, go to installed location “C:\Program Files (x86)\nxlog\conf” and rename the attached NXLog.conf (Windows) to "nxlog.conf" and copy into this folder.

5. Replace “LCP_IP_Address” with actual LCP IP address in nxlog.conf.

6. Apache LOG location (access.log) needs to be mentioned on line 31 against "File". Please see the below screenshot for reference.

7. Now start the nxlog service from services.msc.

8. NxLog agent logs will be available at location "C:\Program Files (x86)\nxlog\data\nxlog.log".

Steps to configure the sever via NxLog Agent for Non-TLS TCP Log flow on Linux (RHEL 7 and CentOS 7) using port - 10013

Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download (There are few dependencies that you need to install and then you can install nxlog on machine. Refer https://nxlog.co/documentation/nxlog-user-guide#deploy_rhel )
For Linux Agent, after installation go to installed location “/etc/nxlog.conf”. Rename attached NXLog.conf(Linux) to "nxlog.conf" and copy into this folder.

3. Replace “LCP_IP_Address” with actual LCP IP address in nxlog.conf.

4. Apache LOG location (access.log) needs to be mentioned on line 24 against "File". Please see the below screenshot for reference.

5. Now start the nxlog service using below command.

systemctl start nxlog

6. NxLog agent logs will be available at location "/var/log/nxlog.log"

Steps to configure the sever via NxLog Agent for TLS TCP Log flow on Linux and Windows using port - 10014

Please follow the below steps for Windows:

Go to services.msc and stop the nxlog service.
Go to folder "C:\Program Files (x86)\nxlog\data" and delete "configcache.dat".
For Windows Agent , go to installed location “C:\Program Files (x86)\nxlog\conf”. Rename attached NXLog.conf (Windows with TLS).conf to "nxlog.conf" and copy into this folder

4. Copy the certificate on Windows machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile".

Example: C:\Program Files (x86)\nxlog\cert\cert.pem

5. Replace “LCP_IP_Address” with actual LCP IP address in nxlog.conf.

6. Apache LOG location (access.log) needs to be mentioned on line 32 against "File". Please see the below screenshot for reference.

7. Now start the nxlog service from services.msc.

8. NxLog agent logs will be available at location "C:\Program Files (x86)\nxlog\data\nxlog.log"

Please follow the below steps for Linux:

Stop the nxlog service using below command.

systemctl stop nxlog

2. For Linux Agent, after installation go to installed location “/etc/nxlog.conf”. Rename attached NXLog.conf(Linux with TLS) to "nxlog.conf" and copy into this folder.

3. Copy the certificate on Linux machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile".

Example: /etc/cert.pem

4. Replace “LCP_IP_Address” with actual LCP IP address in nxlog.conf.

5. Apache LOG location (access.log) needs to be mentioned on line 24 against "File". Please see the below screenshot for reference.

6. Now start the nxlog service using below command.

systemctl start nxlog

7. NxLog agent logs will be available at location "/var/log/nxlog.log"

LCP Configuration Parameters

Table 1-2: The Apache event collector (Syslog - 3844) properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	TCP	The default protocol for syslog.
IP Address	Apache interface IP address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Port Number	10013	The default port number for syslog. Port - 10014 can be used for TLS with TCP. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.