Collect Nix System logs

This document describes how you can collect Nix System logs by enabling Google Cloud telemetry ingestion to Google Security Operations and how log fields of Nix System logs map to Google Security Operations Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google Security Operations .

A typical deployment consists of Nix System logs enabled for ingestion to Google Security Operations. Each customer deployment might differ from this representation and might be more complex.

The deployment contains the following components:

• Google Cloud: The Google Cloud services and products from which you collect logs.

• Nix System logs: The Nix System logs that are enabled for ingestion into Google Security Operations.

• Google Security Operations: Google Security Operations retains and analyzes the logs from Nix System.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information into this document applies to the parser with the NIX_SYSTEM ingestion label.

The following log source paths are supported by the Nix System parser:

• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/nginx/access.log
• /var/log/nginx/error.log
• /var/log/rkhunter.log
• /var/log/auth.log
• /var/log/kern.log
• /var/log/rundeck/service.log
• /var/log/samba/log.winbindd
• /var/log/mail.log
• /var/log/audit/audit.log
• /var/log/syslog
• /var/log/openvpnas.log

Before you begin

• Set up NixOS on Google Compute Engine. For more information, see Install NixOS on GoogleCompute Engine .
• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

Configure Google Cloud to ingest Nix System logs

Nix System is deployed on Google Cloud. You must configure Google Cloud to ingest Nix System logs to Google Security Operations, see Ingest Google Cloud logs to Google Security Operations .

If you encounter issues when you ingest Nix System logs, contact Google Security Operations support .

Supported Nix System log formats

The Nix System parser supports logs in JSON,SYSLOG+JSON and KV format.

Supported Nix System sample logs

• JSON

   {
    "_path": "ssl",
    "_system_name": "zeek-sensor",
    "_write_ts": "2021-12-21T00:58:02.468587Z",
    "ts": "2021-12-21T00:58:02.440196Z",
    "uid": "CzXKYpiKYBEHtfte1",
    "id.orig_h": "198.51.100.0",
    "id.orig_p": 17682,
    "id.resp_h": "198.51.100.1",
    "id.resp_p": 443,
    "version": "TLSv13",
    "cipher": "TLS_AES_256_GCM_SHA384",
    "curve": "x25519",
    "server_name": "dummy.domain.com",
    "resumed": true,
    "established": true,
    "ja3": "598872011444709307b861ae817a4b60",
    "ja3_version": "771",
    "ja3_ciphers": "4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53",
    "ja3_extensions": "0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-41",
    "ja3_ec": "29-23-24",
    "ja3_ec_fmt": "0",
    "ja3s": "2253c82f03b621c5144709b393fde2c9",
    "ja3s_version": "771",
    "ja3s_cipher": "4866",
    "ja3s_extensions": "43-51-41"
  } 
  

• SYSLOG+JSON

   <13>1 2021-12-21T23: 51: 25-08: 00 dummyhostname bro_http - - - {
    "ts": 1640159484.694295,
    "uid": "dummyuid",
    "id.orig_h": "198.51.100.0",
    "id.orig_p": 58729,
    "id.resp_h": "198.51.100.1",
    "id.resp_p": 8088,
    "trans_depth": 2284,
    "method": "POST",
    "host": "198.51.100.2",
    "uri": "/system/gateway",
    "version": "1.1",
    "user_agent": "Java/11.0.11",
    "request_body_len": 304,
    "response_body_len": 203,
    "status_code": 200,
    "status_msg": "OK",
    "tags": [],
    "orig_fuids": [
      "FefIdu4i8dzFTUONb5"
    ],
    "orig_mime_types": [
      "application/xml"
    ],
    "resp_fuids": [
      "Flqz7L3yyQR1eSN4Kf"
    ],
    "resp_mime_types": [
      "application/xml"
    ]
  } 
  

• KV

   <85>Aug 1 19:55:40 dummyhostname sshd[86907]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.17.42.6 user=dummyuser 
  

Field mapping reference

Field mapping reference: Event Identifier to Event Type for Audit logs

The following table lists the Audit logs log types and their corresponding UDM event types.

Field mapping reference: Audit logs

The following table lists the log fields of the Audit logs log type and their corresponding UDM fields.

Field mapping reference: Event Identifier to Event Type for all Log source paths

The following table lists all the remaining log types and their corresponding UDM event types.

Field mapping reference: /var/log/apache2/error.log

The following table lists the log fields of the /var/log/apache2/error.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/apache2/access.log

The following table lists the log fields of the /var/log/apache2/access.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/nginx/access.log

The following table lists the log fields of the /var/log/nginx/access.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/nginx/error.log

The following table lists the log fields of the /var/log/nginx/error.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/kern.log

The following table lists the log fields of the /var/log/kern.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/rundeck/service.log

The following table lists the log fields of the /var/log/rundeck/service.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/openvpnas.log

The following table lists the log fields of the /var/log/openvpnas.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/mail.log

The following table lists the log fields of the /var/log/mail.log log type and their corresponding UDM fields.

Field mapping reference: /var/log/auth.log

The following table lists the log fields of the /var/log/auth.log log type and their corresponding UDM fields.