翻译：http://ossec-docs.readthedocs.io/en/latest/manual/rules-decoders/testing.html
测试OSSEC规则/解码器
大多数人在解决OSSEC或尝试编写新规则和解码时的第一个问题是如何测试它们。在过去，这需要手动重新启动OSSEC，或者创建一个测试安装。在版本1.6中，有一个工具可以简化这个任务(ossec-logtest)。
使用ossec-logtest测试
工具ossec-logtest安装在/var/ossec/bin中。它将读取当前规则和解码器（来自/var/ossec）并接受stdin的日志输入：
# /var/ossec/bin/ossec-logtest 2008/07/04 09:57:28 ossec-testrule: INFO: Started (pid: 12683). ossec-testrule: Type one log per line. Jul 4 09:42:16 enigma sshd[11990]: Accepted password for dcid from 192.168.2.10 port 35259 ssh2 **Phase 1: Completed pre-decoding. full event: "Jul 4 09:42:16 enigma sshd[11990]: Accepted password for dcid from 192.168.2.10 port 35259 ssh2" hostname: "enigma" program_name: "sshd" log: "accepted password for dcid from 192.168.2.10 port 35259 ssh2" **Phase 2: Completed decoding. decoder: ’sshd’ dstuser: ‘dcid’ srcip: ‘192.168.2.10′ **Phase 3: Completed filtering (rules). Rule id: ‘10100′ Level: ‘4′ Description: ‘First time user logged in.’ **Alert to be generated.
在上面的示例中，我们提供了一个身份验证成功日志，而ossec-logtest向我们展示了如何解码、提取哪些信息以及哪些规则被触发。在下一个示例中，我们可以看到它如何从Windows中提取用户下线消息:
# /var/ossec/bin/ossec-logtest 2008/07/04 09:57:28 ossec-testrule: INFO: Started (pid: 12683). ossec-testrule: Type one log per line. WinEvtLog: Security: AUDIT_SUCCESS(538): Security: lac: OSSEC-HM: OSSEC-HM: User Logoff: User Name: lac Domain: OSSEC-HM Logon ID: (0×0,0xF784D5) Logon Type: 2 **Phase 1: Completed pre-decoding. full event: ‘WinEvtLog: Security: AUDIT_SUCCESS(538): Security: lac: OSSEC-HM: OSSEC-HM: User Logoff: User Name: lac Domain: OSSEC-HM Logon ID: (0×0,0xF784D5) Logon Type: 2′ hostname: ‘enigma’ program_name: ‘(null)’ log: ‘WinEvtLog: Security: AUDIT_SUCCESS(538): Security: lac: OSSEC-HM: OSSEC-HM: User Logoff: User Name: lac Domain: OSSEC-HM Logon ID: (0×0,0xF784D5) Logon Type: 2′ **Phase 2: Completed decoding. decoder: ‘windows’ status: ‘AUDIT_SUCCESS’ id: ‘538′ extra_data: ‘Security’ dstuser: ‘lac’ system_name: ‘OSSEC-HM’ **Phase 3: Completed filtering (rules). Rule id: ‘18149′ Level: ‘3′ Description: ‘Windows User Logoff.’ **Alert to be generated.
除了上面的信息之外，还可以使用ossec-logtest-f来跟踪日志的规则路径：
# /var/ossec/bin/ossec-logtest -f 2008/07/04 10:05:43 ossec-testrule: INFO: Started (pid: 23007). ossec-testrule: Type one log per line. Jul 4 10:05:30 enigma sshd[27588]: Failed password for invalid user test2 from 127.0.0.1 port 19130 ssh2 **Phase 1: Completed pre-decoding. full event: ‘Jul 4 10:05:30 enigma sshd[27588]: Failed password for invalid user test2 from 127.0.0.1 port 19130 ssh2′ hostname: ‘enigma’ program_name: ’sshd’ log: ‘Failed password for invalid user test2 from 127.0.0.1 port 19130 ssh2′ **Phase 2: Completed decoding. decoder: ’sshd’ srcip: ‘127.0.0.1′ **Rule debugging: Trying rule: 1 - Generic template for all syslog rules. *Rule 1 matched. *Trying child rules. Trying rule: 5500 - Grouping of the pam_unix rules. Trying rule: 5700 - SSHD messages grouped. *Rule 5700 matched. *Trying child rules. Trying rule: 5709 - Useless SSHD message without an user/ip. Trying rule: 5711 - Useless SSHD message without a user/ip. Trying rule: 5707 - OpenSSH challenge-response exploit. Trying rule: 5701 - Possible attack on the ssh server (or version gathering). Trying rule: 5706 - SSH insecure connection attempt (scan). Trying rule: 5713 - Corrupted bytes on SSHD. Trying rule: 5702 - Reverse lookup error (bad ISP or attack). Trying rule: 5710 - Attempt to login using a non-existent user *Rule 5710 matched. *Trying child rules. Trying rule: 5712 - SSHD brute force trying to get access to the system. **Phase 3: Completed filtering (rules). Rule id: ‘5710′ Level: ‘5′ Description: ‘Attempt to login using a non-existent user’ **Alert to be generated.
