Collector scripting for access error detection
I would like to make an implementation as follows
1. Get login/logout records from audit log into the text log file
2. Collector monitors the text log file
3. Collector scripting checks login error count for specific users
4. Collector scripting rises an alert when login error count is exceeded in the interval
There is not a lot of information and samples for such Collector scripting.
I am very beginner with LogicMonitor customization and I am not familiar with COllector scripting.
Any technical information , samples and comments will be appreciated.
Kiyoshi
Kiyoshi_Egawa
Posted 4 years ago·Last reply 4 years ago
5 comments
LM User
·4 years agoThere's a really good course in the "Training" section of your portal called "Using Groovy in LogicMonitor". Unfortunately, direct linking to a course isn't possible, so you'll have to go search for it yourself. You can go to "All Courses" then filter by "LogicModules" using the checkbox on the left. Should be the last one listed.
This is the documentation on doing scripted data collection. However, this will be the last thing you do in your script. The first thing you'll need to do in your script is connect to the remote system from your Collector, fetch the contents of the log file, then parse through the log file to count all the things you want to count. Then you should reference the documentation to output the data in the proper format. Then you'll create the datasource with your script at the heart.
Kiyoshi_Egawa
OP4 years agoCould you please let me know good tutorial information of Controller scripting ?
LM User
·4 years agoYeah, scripting it will be best (unless you can create your access log in json format with the data already calculated and host that on an http microservice). If you go the scripting route, however you want to script grabbing the contents of that file should be fine: ssh, remote-powershell, SMB, http microservice, etc.
Once you have the log file contents pulled into your script, you'll want to parse through it twice: once to grab the list of users for discovery and once to grab the number of logons per user. I would suggest making a derive datapoint as that will treat the number of logons as a counter. This means that it will take the current count minus the last count and divide by the time between them. You can multiply by ##POLLINTERVAL## to get back to the raw delta.
Kiyoshi_Egawa
OP4 years ago>Which audit log are you talking about? If it's the LM audit log, you might consider fetching the audit log via API.
I'm not talking about LM audit log. It is my own system audit log. From that I make an access log with login/logout recoirds. The collector monitors it as text log file.
I think collector scripting is a better way to scan this access log records.
Could you please let me know if it is feasible ?
LM User
·4 years agoWhich audit log are you talking about? If it's the LM audit log, you might consider fetching the audit log via API. That should allow you to fetch only the "signs in" entries. The endpoint and filter would look like this:
So, you'll need to do an API call through Groovy to the above endpoint. In the above example, I'm also filtering by a specific timeframe and limiting the results to at most 1000 entries. You might want to change the filter to only catch failures, i'm not sure what the filter text would be as I don't have any recent failures on my portal.
After you fetch the data, you should be able to go through it and count up the number of failures per user.
Documentation on that API endpoint: https://www.logicmonitor.com/support/rest-api-developers-guide/v1/access-logs/get-access-log-entries
This script should get you most of the way there. You'll want to modify the resource.logs.data.each loop so that it counts up login failures per user. Right now it just prints them out. You'll also want to dynamically fill in the happenedOn filter to be the timestamp from however far back you want the failures to be counted. Some helpful Groovy time examples.