[2.7-rc1-csyslogd] add md5/sha1 checksums to client syslog CEF output…

… as part of msg=
ossec · Nov 9, 2012 · ec19fd9 · ec19fd9
1 parent 90be4e6
commit ec19fd9
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/os_csyslogd/alert.c b/src/os_csyslogd/alert.c
@@ -171,6 +171,12 @@ int OS_Alert_SendSyslog(alert_data *al_data, SyslogConfig *syslog_config)
         field_add_string(syslog_msg, OS_SIZE_2048, " suser=%s", al_data->user );
         field_add_string(syslog_msg, OS_SIZE_2048, " dst=%s", al_data->dstip );
         field_add_truncated(syslog_msg, OS_SIZE_2048, " msg=%s", al_data->log[0], 2 );
+        if (al_data->new_md5 && al_data->new_sha1) {
+            field_add_string(syslog_msg, OS_SIZE_2048, " Previous MD5: %s", al_data->old_md5 );
+            field_add_string(syslog_msg, OS_SIZE_2048, " Current MD5: %s", al_data->new_md5 );
+            field_add_string(syslog_msg, OS_SIZE_2048, " Previous SHA1: %s", al_data->old_sha1 );
+            field_add_string(syslog_msg, OS_SIZE_2048, " Current SHA1: %s", al_data->new_sha1 );
+        }
     }
     else if(syslog_config->format == JSON_CSYSLOG)
     {