Cisco Duo Log Sync (DLS)

May 21, 20231 min read

Duologsync (DLS) is a utility written by Duo Security that supports fetching logs from Duo endpoints and ingesting them to different SIEMs.

Logging:

A logging filepath can be specified in config.yml. By default, logs will be stored under the /tmp folder with name duologsync.log.

These logs are only application/system logs and not the actual logs retrieved from Duo endpoints.

System Requirements:

Duo Log Sync must run a system set to the UTC/GMT Timezone.

Installation:

▪ Make sure you are running Python 3+:

python3 --version

▪ Clone this GitHub repository and navigate to the duo_log_sync folder:

git clone https://github.com/duosecurity/duo_log_sync.git

▪ Ensure you have "setuptools";

pip3 install setuptools

▪ Install duologsync:

python3 setup.py install

▪ Go to duo_log_sync folder and create a config.yml file:

cd duo_log_sync/

touch config.yml

▪ Edit config.yml file:

vi config.yml

version: '1.0.0'

dls_settings:

log_filepath: '/tmp/duologsync.log'

log_format: 'CEF'

api:

offset: 180

timeout: 120

servers:

- id: 'SYSLOG'

hostname: '127.0.0.1'

port: 514

protocol: 'UDP'

account:

ikey: 'xxxxxxxxxxx'

skey: 'yyyyyyyyyyyy'

hostname: 'xxx.duosecurity.com'

endpoint_server_mappings:

- endpoints: ['adminaction', 'auth', 'telephony']

server: 'SYSLOG'

is_msp: False

▪ Run the application:

duologsync config.yml

STENGE