Missing details for Wazuh syslogs integration

[Molaryy]

We encountered the same issue as: #72

Description

We are using the opentelemetry-collector chart and in one of our exporters we have syslogs redirecting to the wazuh manager worker:

opentelemetry-collector:
...
  alternateConfig:
    exporters:
      syslog/wazuh:
        endpoint: azuh-manager-worker.<namespace>.svc.cluster.local
        network: tcp
        port: 514
        protocol: rfc3164
        tls:
          insecure: true

2 things are required in the wazuh helm chart to successfully finish the setup (if not done we'll not be able to visualize them in the Wazuh Dashboard)

1)

The default value of <logall_json> field in /var/ossec/etc/ossec.conf is no, we need to change the value to yes to enable storing log events.

wazuh:
  wazuh:
    master:
      extraConf: |
        <global>
          <logall_json>yes</logall_json>
        </global>
    worker:
      extraConf: |
        <global>
          <logall_json>yes</logall_json>
        </global>

2)

In the wazuh-manager-worker pod, the default value of archives.enabled in /etc/filebeat/filebeat.yml is set to false, true is required to enable archive logs processing, we couldn't find anything related to this in the current chart, a workaround that we found is basically creating a ConfigMap (e.g: templates/filebeat-config.yaml) that exactly matches the content of /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml but now with archives.enabled: true.

Workaround

template/filebeat-config.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: wazuh-filebeat-config
data:
  filebeat.yml: |

    # Wazuh - Filebeat configuration file
    filebeat.modules:
      - module: wazuh
        alerts:
          enabled: true
        archives:
          enabled: true
    ...

values.yaml

wazuh:
  wazuh:
    master:
      extraConf: |
        <global>
          <logall_json>yes</logall_json>
        </global>
      additionalVolumes:
        - name: filebeat-config
          configMap:
            name: wazuh-filebeat-config
      additionalVolumeMounts:
        - name: filebeat-config
          mountPath: /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml
          subPath: filebeat.yml
          readOnly: true
    worker:
      extraConf: |
        <global>
          <logall_json>yes</logall_json>
        </global>
      additionalVolumes:
        - name: filebeat-config
          configMap:
            name: wazuh-filebeat-config
      additionalVolumeMounts:
        - name: filebeat-config
          mountPath: /var/ossec/data_tmp/exclusion/etc/filebeat/filebeat.yml
          subPath: filebeat.yml
          readOnly: true

[morgoved]

you can create PR for add this)

[Molaryy]

@morgoved Yes I'm in the process :)