715184 - Sync CEF Logging Bug

Status: VERIFIED FIXED

(Cloud Services Graveyard :: Server: Sync, defect)

Description

[Eric Parker [:parker]]

Attachment: sync login failures

Hi
It seems that the Sync CEF logging has changed sometime in the recent past.  Looking through the logs and comparing them to previous ArcSight rules that were written I found discrepancies on what is expected.  For example the when there is a authentication failure I am currently receiving the CEF event but the Device Event Class ID (deviceClassID) = "Authentication Failed for Backend service kizyjwbazb4hg23q33qgsbkdm52tmafv"

According to the rule (written by nmiller) the rule is expecting deviceClassID =  "AuthFail"

I have also noticed that the user name field is not completed for events.  This should be in the CEF field "suser".  It would helpful to us to receive the Username and not the User ID.  

Attached are two examples of the syslog events being sent.  First file shows the CEF authentication failures and the second is the "Daily  metric call".  These are the actual CEF syslog events.  

In short, we need to have the Authentication Failures corrected to specify the correct user name in the "suser" CEF field, either by Captcha or user interaction and have the other events specified in the logging requirements.  The sync requirements document can be found here, https://mana.mozilla.org/wiki/display/INFRASEC/Sync+CEF+Messages

Comment 1

[Eric Parker [:parker]]

Attachment: General login's without user

Comment 2

[Ryan Kelly [:rfkelly]]

This looks like it should have been fixed by http://hg.mozilla.org/services/server-core/rev/ecbe9a975867.  Perhaps just not rolled out yet?

The new repoze.who authentication routines are using the old, incorrect messages, but I don't think that code has been enabled yet.  I'll update to the correct format in any case.

Comment 3

[Ryan Kelly [:rfkelly]]

Attachment: patch fixing cef log messages in whoauth module

Comment 4

[Toby Elliott [:telliott]]

Yeah, this is one of the bugs that is blocked by lack of ops resources to roll out the fix. I'm hoping these come unstuck within the next week and we can push some forwards.

Comment 5

[Eric Parker [:parker]]

Hi,
Thanks again for taking this on.  Any ETA when this will be rolled out?

Eric

Comment 6

[Toby Elliott [:telliott]]

Some of these should be rolled out today and tomorrow. The others are not scheduled to happen because we've declared the current Sync nodes to be a dead end and we are working on new sync code to be deployed in 6-8 weeks.