Graylog2 / Graylog2/graylog2-server

Add received timestamp (server time) for forensic analysis

Open
#3,816 0 comments 4 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Having a remote copy of logs from a client is useful for forensic analysis since, once a client is compromised, the logs on the client itself cannot be trusted because they may have been modified by the attacker. Log messages sent to the server from before the time of the compromise can be trusted; log messages sent after this time cannot (even if the timestamp in the log messages is before the compromise) because the attacker may have been able to send arbitrary log messages after the compromise.

However, to allow log analysts to take advantage of this, Graylog needs to reliably record the time of receipt of the log message. Currently Graylog does not do this in most configurations because the `timestamp` field is filled in based on the timestamp in the log message (which is generated by the client) when that can be parsed.

An additional field, `gl2_receipt_timestamp`, should be added to each received message; this should be filled in with the current time on the server when the message is received. The client must not be able to override the contents of this field.

Additionally, this field should not be hidden in the UI when listing "fields of the current page (of results)" to make it clear to someone doing log analysis that the `timestamp` field is generally not the time of receipt but was generated by the client. It would also be a good idea not to hide the `gl2_remote_ip` field as well.

## Environment

* Graylog Version: 2.2.3

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.