Retrieving Logs - Without Agent

[raphaeleid]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Dears,

I am trying to retrieve logs from a machine, on-cloud, on the same subnet as the Distributed environnment.

I tried to install an agent, that could be found under SOC -> Downloads (for linux), allowed from the firewall, and from SOC Administration Console under elastic_agent_endpoint, it worked perfectly. I was able to retrieve authentication logs.

Now the second test is to retrieve logs without elastic-agent, I added the IP under Administration–> Configuration –> firewall –> hostgroups. I wasnt able to receive authentication logs. I received logs under endpoint.events.process

Is this normal? Do we need elastic-agent to retrieve authentication logs (SSH), the same thing for Application Logs (Oracle DB for example)

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[robbiemarshall]

In 2.4, you'll need the elastic agent to ingest endpoint logs. However, you can still ingest syslog without the agent if necessary: https://docs.securityonion.net/en/2.4/syslog.html