Accenture MDR Quick Start Guide for WSO2 Identity Server(IS) and API Manager (AM) Event collector (Generic TCP)

This quick start guide will help Accenture Security customers configure WSO2 IS and AM to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document

(Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring WSO2 IS and AM

Audit logs are enabled in WSO2 Identity Server by default and below is the audit log configuration procedure.

1. Navigate to Installed path of WSO2IS. The default path is <IS_HOME>/repository/conf/log4j2.properties.

2. Update the following in the log4j2.and the file will be look like below

3. We need to configure the appender.AUDIT_LOGFILE.layout.pattern as mentioned in the above file, the meaning of the each directive as follows:

4. Log Level Can be matched from appender.AUDIT_LOGFILE.filter.threshold.level = INFO

HTTP ACCESS LOG

Configuring access logs for the HTTP servlet transport

1.  Open the <IS_HOME>/repository/conf/deployment.toml file.

2. Add the following configuration.
   time=%t remoteHostname=%h localPort=%p localIP=%A requestMethod=%m requestURL=%U remoteIP=%a requestProtocol=%H HTTPStatusCode=%s queryString=%q X-Forwarded-For=%{X-Forwarded-For}

3. Restart the server. According to the configurations, a log file named http_access.{DATE}.log is created by default inside the <IS_HOME>/repository/logs directory. The log is rotated on a daily basis.

1. Audit logs are enabled by default in WSO2 API Manager (WSO2 API-M) via the following configurations, which are in the <API-M-HOME>/repository/conf/log4j2.properties file.

2. We need to configure the appender.AUDIT_LOGFILE.layout.pattern as mentioned in the above file, the meaning of the each directive as follows:

3. Log Level Can be matched from appender.AUDIT_LOGFILE.filter.threshold.level = INFO

 HTTP ACCESS LOG

Configuring access logs for the HTTP servlet transport

1. Open the /repository/conf/deployment.toml file.

2. Add the following configuration.

   [http_access_log] useLogger = true

3. Open /repository/conf/log4j2.properties file:

4. Add HTTP_ACCESS to the existing "appenders":

5. Add HTTP_ACCESS to existing "loggers"
   
   

6. Add logger configurations for HTTP_ACCESS log

7. Add appender configurations for HTTP_ACCESS log

8. Restart the server.

By Default the access logs related to service/API invocation are disabled for performance reasons on the device. We need to enable it by following configuration:

1. Open <API-M_HOME>/conf/log4j2.properties file and add following configuration for PassThroughAccess logger.

2. Append PassThroughAccess logger name to loggers configuration, which is a comma-separated list of all active loggers.

3. Create a file named access-log.properties in <API-M_HOME>/repository/conf/ location with the following configuration and Please use the below template.

4. You need to configure the access_log_pattern as mentioned above.

5. Add the following configuration in the <API-M_HOME>/repository/conf/deployment.toml file.

6. Restart the server.

NxLog Configuration

To configure Nxlog Agent, follow any one of the below options as per supported OS

Windows NxLog Agent for Non TLS TCP (Windows)

Windows NxLog Agent for Non TLS TCP (Linux RHEL 7 and CentOS 7)

Windows NxLog Agent for TLS TCP (Windows or Linux)

1. Download and Install NxLog agent from Download

2. Go to services.msc and stop the nxlog service

3. Navigate to folder C:\Program Files (x86)\nxlog\data and delete configcache.dat

4. For Windows Agent , go to installed location “C:\Program Files (x86)\nxlog\conf”. Rename attached NXLog.conf (Windows) to "nxlog.conf" and copy into this folder
   

5. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf

6. Change Apache access.log file location on line 31

7. Start the nxlog service from services.msc

8. NxLog agent logs will be available at location "C:\Program Files (x86)\nxlog\data\nxlog.log"

9. Log flow should work and you can check on tcpdump using command "tcpdump –AA port 10013"

1. Download and Install NxLog agent from Download

2. For Linux Agent, Navigate to installed location “/etc/nxlog.conf”. Rename below attached NXLog.conf(Linux).conf  to "nxlog.conf" and copy into this folder

Open

3. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf

4. Change Vault vault_audit.log file location on line 24

5. Now start the nxlog service using below command

6. NxLog agent logs will be available at location "/var/log/nxlog.log"

1. Download and Install NxLog agent from location Download

2. Stop the nxlog service

   1. Go to services.msc and stop the nxlog service for windows. Navigate to folder C:\Program Files (x86)\nxlog\data and delete configcache.dat

   2. Enter the command systemctl stop nxlog for Linux

3. Navigate to installed location.

   1. For Windows Agent , go to installed location “C:\Program Files (x86)\nxlog\conf”. Rename attached NXLog.conf (Windows) to "nxlog.conf" and copy into this folder

Open

Open

Note: Please contact the Accenture MDR onboarding team to obtain the certificate

4. Copy this certificate on Windows machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile" on line number 47. 

5. Copy this certificate on Linux machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile" on line number 28. 

6. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf

7. Change Apache access.log file location on line 32 on Windows

8. Change Apache access.log file location on line 24 on Linux

9. Start the nxlog service

   1. Now start the nxlog service from services.msc for windows

   2. Now start the nxlog service using command -systemctl start nxlog for Linux

10. NxLog agent logs will be available at location "C:\Program Files (x86)\nxlog\data\nxlog.log" for windows

11. NxLog agent logs will be available at location "/var/log/nxlog.log" for Linux

12. Log flow should work and you can check on tcpdump using command "tcpdump –AA port 10014"

LCP Configuration Parameters

Table 1-2: The WSO2 IS and AM event collector (Generic TCP-4029) properties to be configured by MDR are shown in the table.