cowrie/doc/graylog

How to process Cowrie output into Graylog

Prerequisites

• Working Cowrie installation
• Working Graylog installation

Cowrie Configuration

• Open the Cowrie configuration file and uncomment these 3 lines.

[output_localsyslog]
facility = USER
format = text

• Restart Cowrie

Graylog Configuration

• Open the Graylog web interface and click on the System drop-down in the top menu. From the drop-down menu select Inputs. Select Syslog UDP from the drop-down menu and click the Launch new input button. In the modal dialog enter the following information.

Title: Cowrie Port: 8514 Bind address: 127.0.0.1

• Then click Launch.

Syslog Configuration

• Create a rsyslog configuration file in /etc/rsyslog.d

$ sudo nano /etc/rsyslog.d/85-graylog.conf

• Add the following lines to the file

$template GRAYLOGRFC5424,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msg%\n"
*.* @127.0.0.1:8514;GRAYLOGRFC5424

• Save and quit.

• Restart rsyslog

$ sudo service rsyslog restart