Read local log file from PC

Content Authoring
1

i need help with creating a fixlet to read log files from every PC at this location
C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG
and send an email if there is a threat or view via on the bigfix console

is this possible?

Thanks Guys

2

You can create a analysis to do that & view them from webreport.

lines of file “C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG”

3

will the log file be under Revelance

Pasted image1182×988 7.91 KB

4

use this one - lines of file “C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG”

5

Thanks vk.Khurava - what is the relevance to send an email if “action is taken” is found in the log

could it be

ActionTaken=ARW_ACTION_KILL_THREAD - email itsupport@company.com

6

its nothing like that just go in webreport & CreateScheduledActivity but to achive that you must have SMTP server configured 1st.

7

ok checking it out now. thanks

9

i setup the Schedule Activity but its not allowing me to choose a specific analysis

Pasted image771×729 10.2 KB

10

made some more changes to the relevance

file “C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG” line starts with “ActionTaken=ARW_ACTION_KILL_THREAD”

however is keeps reporting as “undefined”

Please help. thanks

11

The relevance format is wrong

If you just want a “True” if the string is there then it would be

exists line whose ( it starts with "ActionTaken=ARW_ACTION_KILL_THREAD" ) of file "C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG"
12

no matter what i try it keeps saying error, i even changed it to a word that i know is showing in the log file

exists line whose ( it starts with “ntfs” ) of file “C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG”

13

If you hover over the "<error>" it will show what the error is

14

Thanks AlanM - i did not know that - the error reads “the expression could not be validated”

15

I can’t find that exact text.

Can only find:

This expression could not be parsed.
The expression could not be understood
16

sorry

the expression could not be evaluated

17

Is the file “MBAMSERVICE.LOG” in use by Malware bytes at the time? If the file is “Locked” for writing, then BigFix may not be able to read the file.

18

That works TimRice - thank you

now all i have to do is figure out how to search a working log file :slight_smile:

19

The “could not be evaluated” suggests a relevance syntax or command error so that is not the same.

Can you post your exact analysis relevance?

20

here it is

exists line whose (it contains “ActionTaken=ARW_ACTION_KILL_THREAD” ) of file “C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG”

if i save the file to another location it works but since MalwareBytes lock the file for writing logs it does not work

21

That is going to be the issue then. You won’t be able to do this in an analysis unless you do it on a copy of a file made by an action.