Parameter to specify the log level of individual Log rules #138

jjxtra · 2021-03-12T17:48:25Z

jjxtra
Mar 12, 2021
Maintainer

Hi there!

My co-worker and I were wondering if there is a possibility to get a feature added to specify the log level for each FailedLoginRegex and SuccessfulLoginRegex within an individual block.

This would allow to have much cleaner log files, since you can then specify in the nlog.config in what file to log e.g. INFO or WARN messages. Right now I saw that the log level of a failed and successful login is hardcoded to WARN in the code.

This is how an example config entry could look like:

<LogFile>
        <Source>Dummy</Source>
        <PathAndMask>C:\Program Files (x86)\Test\Logging\*.log</PathAndMask>
        <Recursive>false</Recursive>
        <FailedLoginRegex><![CDATA[      ]]></FailedLoginRegex>
         <FailedLoginLogLevel>WARN</FailedLoginLogLevel>
        <SuccessfulLoginRegex><![CDATA[     ]]></SuccessfulLoginRegex>
         <SuccessfulLoginLogLevel>INFO</SuccessfulLoginLogLevel>
        <PlatformRegex>Windows</PlatformRegex>
        <PingInterval>10000</PingInterval>
        <MaxFileSize>16777216</MaxFileSize>
</LogFile>

Thanks and keep up the good work!

jjxtra · 2021-03-14T22:05:34Z

jjxtra
Mar 14, 2021
Maintainer Author

Refreshed the 1.6.0 binaries with this feature. Simply add a FailedLoginThreshold override.

0 replies

RvdHout · 2021-05-24T10:00:27Z

RvdHout
May 24, 2021

Hi, @jjxtra
Is it possible this change breaks normal logging? For example successful and failed RDP connections attempts?

previously i would have been shown:

2021-05-24 11:15:34.6171|WARN|DigitalRuby.IPBanCore.Logger|Login succeeded, address:  xxx.xxx.xxx.xxx, user name: Username, source: RDP
2021-05-24 11:15:34.6508|WARN|DigitalRuby.IPBanCore.Logger|Updating firewall with 0 entries...
2021-05-24 11:15:34.6508|INFO|DigitalRuby.IPBanCore.Logger|Firewall entries updated:

But now it doesn't show any info like that for a RDP connection, eg it only displays:

2021-05-24 11:48:02.3129|WARN|DigitalRuby.IPBanCore.Logger|Updating firewall with 0 entries...
2021-05-24 11:48:02.3129|INFO|DigitalRuby.IPBanCore.Logger|Firewall entries updated:

2 replies

RvdHout May 24, 2021

PS, should the colon in 'Firewall entries updated:' not be a dot or removed completely?

jjxtra May 24, 2021
Maintainer Author

Not sure what's going on with your logger, I wrote a quick unit test for a successful rdp login and it did log as a warning by default. What is your nlog.config file setup as?

RvdHout · 2021-05-24T21:42:00Z

RvdHout
May 24, 2021

Hi Jeff,

nlog.config is default, eg:

<?xml version="1.0"?>
<nlog xmlns="http://www.nlog-project.org/schemas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" throwExceptions="false" internalLogToConsole="false" internalLogToConsoleError="false" internalLogLevel="Trace">
  <targets>
    <target name="logfile" xsi:type="File" fileName="${basedir}/logfile.txt" archiveNumbering="Sequence" archiveEvery="Day" maxArchiveFiles="28" encoding="UTF-8"/>
    <target name="console" xsi:type="Console"/>
  </targets>
  <rules>
    <logger name="*" minlevel="Info" writeTo="logfile"/>
    <logger name="*" minlevel="Info" writeTo="console"/>
  </rules>
</nlog>

I had a earlier 1.6.0 package on my PC (previously downloaded) and that version logs the failed/succeeded RDP connections fine
OS version detected: Name: Windows, Version: 10.0.17763, Friendly Name: Microsoft Windows Server 2019 Standard, Description: Microsoft Windows 10.0.17763, app version: 1.6.0

Here is a log entry for a failed login with latest 1.6.0 download:

2021-05-23 14:33:01.9444|INFO|DigitalRuby.IPBanCore.Logger|IP blacklisted: False, user name blacklisted: True, fails user name white list regex: False, user name edit distance blacklisted: False
2021-05-23 14:33:01.9444|WARN|DigitalRuby.IPBanCore.Logger|Banning ip address: 187.18.104.33, user name: administrator, config black listed: True, count: 2, extra info: , duration: 90.00:00:00
2021-05-23 14:33:02.0075|WARN|DigitalRuby.IPBanCore.Logger|Updating firewall with 1 entries...
2021-05-23 14:33:02.0075|INFO|DigitalRuby.IPBanCore.Logger|Firewall entries updated: 187.18.104.33

vs previous 1.6.0 build:

2021-05-24 22:01:10.7154|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 171.5.164.41, administrator, RDP, 2
2021-05-24 22:01:10.7154|INFO|DigitalRuby.IPBanCore.Logger|IP blacklisted: False, user name blacklisted: True, fails user name white list regex: False, user name edit distance blacklisted: False
2021-05-24 22:01:10.7154|WARN|DigitalRuby.IPBanCore.Logger|Banning ip address: 171.5.164.41, user name: administrator, config black listed: True, count: 2, extra info: , duration: 90.00:00:00
2021-05-24 22:01:10.9485|WARN|DigitalRuby.IPBanCore.Logger|Updating firewall with 1 entries...
2021-05-24 22:01:10.9485|INFO|DigitalRuby.IPBanCore.Logger|Firewall entries updated: 171.5.164.41

As you can see it really is missing Login failure and Login succeeded entries/rows.
Or maybe i am missing something? When LogLevel is Info it has to log more then with LogLevel Warn, isn't?

2 replies

RvdHout May 28, 2021

@jjxtra

You can not reproduce this?
Something fishy is going on here, lines listed below are still missing with latest download,

2021-05-24 11:15:34.6171|WARN|DigitalRuby.IPBanCore.Logger|Login succeeded, address: xxx.xxx.xxx.xxx, user name: Username, source: RDP

2021-05-24 22:01:10.7154|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 171.5.164.41, administrator, RDP, 2

nlog.config is 100% default and ipban.config is 99% default.... only some appsettings are modified, whitelisting, blacklisting etc, i have no other customizations

jjxtra May 28, 2021
Maintainer Author

I dropped an empty test.log into c:/IPBanCustomLogs, waited for a cycle, then wrote this line:

2020-05-28T01:01:01Z, ipban failed login, ip address: 50.10.10.10, source: RDP, user: test

The next cycle logged correctly the failed login.

RvdHout · 2021-05-28T15:34:23Z

RvdHout
May 28, 2021

Huh? I do not use any IPBanCustomLogs
RDP failed and successful logins read from EventViewer (used) to log directly to C:\Program Files\IPBan\logfile.txt in previous 1.6.0 build, but do not with newest build

Add FailedLoginLogLevel and SuccessfulLoginLogLevel option for log file entries and LogLevel option event viewer entries. This log level will be used when writing the event to the log file. Default is Warning if not specified.

Either above is not documented very clearly of something else has changed.... but it refuses to log failed and successful logins lines like:

2021-05-24 11:15:34.6171|WARN|DigitalRuby.IPBanCore.Logger|Login succeeded, address:  xxx.xxx.xxx.xxx, user name: Username, source: RDP
2021-05-24 11:15:34.6508|WARN|DigitalRuby.IPBanCore.Logger|Updating firewall with 0 entries...
2021-05-24 11:15:34.6508|INFO|DigitalRuby.IPBanCore.Logger|Firewall entries updated:

Although it logs:

2021-05-24 11:48:02.3129|WARN|DigitalRuby.IPBanCore.Logger|Updating firewall with 0 entries...
2021-05-24 11:48:02.3129|INFO|DigitalRuby.IPBanCore.Logger|Firewall entries updated:

But as you see it leaves out this line:

2021-05-24 11:15:34.6171|WARN|DigitalRuby.IPBanCore.Logger|Login succeeded, address:  xxx.xxx.xxx.xxx, user name: Username, source: RDP

1 reply

jjxtra May 28, 2021
Maintainer Author

The log file stuff was just an example to prove that success and fail logins were written as warning log level by default by the current 1.6.0 release.

RvdHout · 2021-05-28T19:02:14Z

RvdHout
May 28, 2021

Not for succeeded/failed attempts using EventViewer as it seems.... something got broken, i simply can not understand you can not reproduce it...nothing weird in my .config (almost using all defaults as said)

1 reply

jjxtra May 28, 2021
Maintainer Author

You are welcome to install visual studio community (run as administrator) and debug into this test. It logs as warning for me:

Test Success: https://github.com/DigitalRuby/IPBan/blob/master/IPBanTests/IPBanBanTests.cs#L142
Test Failure: https://github.com/DigitalRuby/IPBan/blob/master/IPBanTests/IPBanBanTests.cs#L154
Success login log: https://github.com/DigitalRuby/IPBan/blob/master/IPBanCore/Core/IPBan/IPBanService_Private.cs#L395
Failed login log: https://github.com/DigitalRuby/IPBan/blob/master/IPBanCore/Core/IPBan/IPBanService_Private.cs#L334

Also verified with a clean 1.6.0 install with real log file and event viewer entries.

RvdHout · 2021-05-28T22:56:44Z

RvdHout
May 28, 2021

@jjxtra
I just downloaded the latest 1.6.0 again from https://github.com/DigitalRuby/IPBan/releases/tag/1.6.0, this version seems to work OK
One thing i noticed the hashes are different then before, although last week i downloaded it using the install script....could that be the reason?

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/DigitalRuby/IPBan/master/IPBanCore/Windows/Scripts/install_latest.ps1'))

[EDIT], oh...another fresh build, not? This version work 👍 (without changing anything in my config)

Last weeks: DigitalRuby.IPBan.exe (dated 04/09/2021)

CRC32: 0E410E5C
MD5: F18717BEEEA99481950C5F684B0F847B
SHA-1: FFB5601DED0BAFFFB55EE280C05BD9CB6DE9EACE

Now: DigitalRuby.IPBan.exe (dated 05/28/2021)

CRC32: B7A5456D
MD5: EFE7739C9BE25F4DC5D87425DC957394
SHA-1: C110F65F774DD1CD7C325090B3AA77C032E8160D

1 reply

jjxtra May 28, 2021
Maintainer Author

I added the new config file with example of the new log file entry but they are commented out. If the exe changed must be due to the dispose call change.

RvdHout · 2021-05-29T08:28:52Z

RvdHout
May 29, 2021

I tried to locate the older zip file i downloaded/installed earlier last week, but it was nowhere to be found on my local system anymore as the install_latest.ps1 script deletes that after extraction, i think the reason it didn't log properly will remain a mystery but I am glad it works again with latest build,

PS, you have a typo in 09fdd59#comments

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Parameter to specify the log level of individual Log rules #138

{{title}}

Replies: 7 comments 7 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Parameter to specify the log level of individual Log rules #138

jjxtra Mar 12, 2021 Maintainer

Replies: 7 comments · 7 replies

jjxtra Mar 14, 2021 Maintainer Author

jjxtra May 24, 2021 Maintainer Author

jjxtra May 28, 2021 Maintainer Author

jjxtra May 28, 2021 Maintainer Author

jjxtra May 28, 2021 Maintainer Author

jjxtra May 28, 2021 Maintainer Author

jjxtra
Mar 12, 2021
Maintainer

Replies: 7 comments 7 replies

jjxtra
Mar 14, 2021
Maintainer Author

jjxtra May 24, 2021
Maintainer Author

jjxtra May 28, 2021
Maintainer Author

jjxtra May 28, 2021
Maintainer Author

jjxtra May 28, 2021
Maintainer Author

jjxtra May 28, 2021
Maintainer Author