AWS CloudWatch Logs

New in version 4.0.0.

AWS CloudWatch Logs is a service that allows the users to centralize the logs from all their systems, applications, and AWS services in a single place. In order to understand how Cloudwatch Logs works it is important to learn about the following concepts:

  • Log events: CloudWatch saves the logs generated by the application or resource being monitored as log events. A log event is a record with two properties: the timestamp when the event occurred and the raw log message.

  • Log streams: Log events are stored in log streams. A log stream represents a sequence of events coming from the application instance or resource being monitored. All log events in a log stream share the same source.

  • Log groups: Log streams are grouped using log groups. A log group defines a group of log streams that share retention, monitoring, and access control settings.

AWS configuration

AWS CloudWatch logs can be accessed by configuring CloudWatch to store them into a bucket or by using the CloudWatch Logs Agent. The AWS API allows Wazuh to retrieve those logs, analyze them, and raise alerts if applicable.

Wazuh configuration

  1. Open the Wazuh configuration file (/var/ossec/etc/ossec.conf) and add the following configuration block to enable the integration with CloudWatch Logs:

    <wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>5m</interval>
  <run_on_start>yes</run_on_start>
  <service type="cloudwatchlogs">
  <aws_profile>default</aws_profile>
    <aws_log_groups>example_log_group</aws_log_groups>
    <regions>us-east-1</regions>
  </service>
</wodle>

    Users must specify at least one AWS log group from where the logs will be extracted. Multiple regions can be added separated by commas. If no region is specified the module will look for the log group in every available region.

    Note

    Check the AWS S3 module reference manual to learn more about each setting.

  2. Restart Wazuh in order to apply the changes:

    • If you are configuring a Wazuh manager:

      1. For Systemd:

      # systemctl restart wazuh-manager

      1. For SysV Init:

      # service wazuh-manager restart

    • If you are configuring a Wazuh agent:

      1. For Systemd:

      # systemctl restart wazuh-agent

      1. For SysV Init:

      # service wazuh-agent restart