gcp-bucket

This configuration section is used to configure the Google Cloud Storage bucket module.

Options

Main options

enabled
bucket
logging (deprecated)

Scheduling options

run_on_start
interval
day
wday
time

Main options

enabled

Enables or disables the module.

Default value	yes
Allowed values	yes, no

bucket

Defines a bucket to process. It must have its type attribute defined. It supports multiple instances of this option.

<bucket type="access_logs">
</bucket>

Bucket attributes

Attributes	Allowed values	Mandatory/Optional
type (attribute)	access_logs	Mandatory

Bucket options

Options	Allowed values	Mandatory/Optional
name	Any valid bucket name	Mandatory
credentials_file	Path to a credentials file. It can be absolute or relative to WAZUH_HOME	Mandatory
path	Any valid path	Optional
only_logs_after	Valid date in YYYY-MMM-DD format	Optional
remove_from_bucket	A value to determine if each log file is deleted once it has been collected by the module	Optional

type (attribute)

Specifies the type of bucket.

Default value	n/a
Allowed values	access_logs

name

Name of the Google Cloud Storage bucket from which logs are read.

Default value	n/a
Allowed values	Any valid bucket name

credentials_file

Path to the Google Cloud credentials file. It can be an absolute path or relative to WAZUH_HOME.

Default value	n/a
Allowed values	Any path to a credentials file

For example <credentials_file>wodles/gcp-bucket/credentials.json</credentials_file>.

path

Bucket path or prefix.

Default value	n/a
Allowed values	Valid path

only_logs_after

Parse logs from a specific date onwards. It must follow the YYYY-MMM-DD format (for example, 2021-Jun-01); a numeric month is not accepted.

Default value	Date of execution at `00:00:00`
Allowed values	Valid date [YYYY-MMM-DD]

remove_from_bucket

Remove the logs from the Google Cloud Storage bucket once the module reads them.

Default value	no
Allowed values	yes, no

logging

Deprecated since version 5.0.0: The module still accepts the <logging> tag inside <gcp-bucket> for backward compatibility, but ignores it and logs a debug message saying the setting is skipped. Remove it from the configuration.

Scheduling options

run_on_start

Run the module on Wazuh service start or restart.

Default value	yes
Allowed values	yes, no

interval

Time interval between module executions.

Default value	1h
Allowed values	A positive number that should contain a suffix character indicating a time unit, such as s (seconds), m (minutes), h (hours), d (days), w (weeks), M (months)

day

Day of the month to retrieve logs from GCP.

Default value	n/a
Allowed values	Day of the month [1..31]

Note

When the day option is set, the interval value must be a multiple of months. By default, the interval is set to a month.

wday

Day of the week to retrieve logs from GCP. This option is not compatible with the day option.

Default value	n/a
Allowed values	Day of the week: - sunday/sun - monday/mon - tuesday/tue - wednesday/wed - thursday/thu - friday/fri - saturday/sat

Note

When the wday option is set, the interval value must be a multiple of weeks. By default, the interval is set to a week.

time

Time of the day to retrieve logs from GCP. It has to be represented in the format hh:mm. This option is compatible with day or wday options.

Default value	n/a
Allowed values	Time of day [hh:mm]

Note

When only the time option is set, the interval value must be a multiple of days or weeks. By default, the interval is set to a day.

Configuration example

Linux configuration:

<gcp-bucket>
  <run_on_start>yes</run_on_start>
  <interval>1m</interval>
  <bucket type="access_logs">
    <name>wazuh-test-bucket</name>
    <credentials_file>/var/ossec/wodles/gcloud/credentials.json</credentials_file>
    <only_logs_after>2021-JUN-01</only_logs_after>
    <path>access_logs/</path>
    <remove_from_bucket>no</remove_from_bucket>
  </bucket>
</gcp-bucket>