PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : Syslog-ng und iptables



$kuLL
08.04.04, 16:15
Hallo Leute,

ich habe den syslog-ng laufen und logge verworfene iptables Pakete.
Meine Filter Rule für den syslog-ng sieht so aus:




filter f_messages { not facility(news, mail); };
filter f_iptables { facility(kern) and match("IN=") and match("OUT="); };

destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };

destination firewall { file("/var/log/firewall"); };
log { source(src); filter(f_iptables); destination(firewall); };

Das klappt auch wunderbar, nur habe ich die iptables Logs ja nun in /var/log/firewall und /var/log/messages. Aus letzterem möchte ich die aber raushaben.

Ich habe nun schon wie ein Wilder mit not facility und not match versucht die iptables Logs aus messages rauszubekommen, aber entweder bekomme ich einen Syntaxfehler oder es klappt nicht. :ugly:

Ich steh total aufm Schlauch, ich hoffe jemand von euch kann mich davon runterschupsen. ;)

Danke schonmal.
$kuLL

Jasper
08.04.04, 19:43
dafür gibt es das flag "final".


-j

$kuLL
08.04.04, 20:31
Hallo Jasper, ich wusste, dass du darauf antworten würdest ;)

So zum Thema:
Ich dachte das final Flag kommt zum tragen, wenn in einem log Block mehrere destinations angegeben sind.
Oder hab ich da was falsch verstanden?!?

Jasper
08.04.04, 21:31
Ich dachte das final Flag kommt zum tragen, wenn in einem log Block mehrere destinations angegeben sind.
Oder hab ich da was falsch verstanden?!?

final bedeutet nur, dass das verarbeiten der logmessage damit beendet ist. bei mir sieht das so aus:

log {
source(local);
filter(wlan);
destination(wlan);
flags(final);
};

log {
source(local);
filter(iptables);
destination(iptables);
flags(final);
};

log {
source(local);
filter(kern);
destination(kern);
};

...

log {
source(local);
filter(messages);
destination(messages);
flags(fallback);
};

wlan-und iptables meldungen will ich weder in kernel noch in messages haben. also schreibe ich die log-blöcke ganz an den anfang und setze final. damit erreichen die meldungen den kernel- oder messages-block gar nicht erst.


-j

$kuLL
08.04.04, 21:55
Hey klasse, danke!

horace
08.11.04, 21:08
Hi!

Ich habe mich auch mal versucht, mit der Thematik zu befassen. Auch ich möchte die Logs von Iptables ausschließlich in der /var/log/firewall haben.

Die Filter scheinen zu funktionieren, die Meldungen landen zumindest schonmal in der dafür vorgesehenen Datei ...nur leider auch noch in der messages.

Eventuell kann sich mal einer von euch meine syslog-ng.conf anschauen und erkennen, wo der Fehler liegt? Die Zeilen, die ich hinzugefügt habe, sind fett markiert. Danke!


#
# Configuration file for syslog-ng under Debian
#
# attempts at reproducing default syslog behavior

# the standard syslog levels are (in descending order of priority):
# emerg alert crit err warning notice info debug
# the aliases "error", "panic", and "warn" are deprecated
# the "none" priority found in the original syslogd configuration is
# only used in internal messages created by syslogd


######
# options

options {
#
long_hostnames(0);

# the time to wait before a died connection is re-established
# (default is 60)
time_reopen(10);

# the time to wait before an idle destination file is closed
# (default is 60)
time_reap(360);

# the number of lines buffered before written to file
# you might want to increase this if your disk isn't catching with
# all the log messages you get or if you want less disk activity
# (say on a laptop)
# (default is 0)
#sync(0);

# the number of lines fitting in the output queue
log_fifo_size(2048);

# enable or disable directory creation for destination files
create_dirs(yes);

# default owner, group, and permissions for log files
# (defaults are 0, 0, 0600)
#owner(root);
group(adm);
perm(0640);

# default owner, group, and permissions for created directories
# (defaults are 0, 0, 0700)
#dir_owner(root);
#dir_group(root);
dir_perm(0755);

# enable or disable DNS usage
# syslog-ng blocks on DNS queries, so enabling DNS may lead to
# a Denial of Service attack
# (default is yes)
use_dns(no);

# maximum length of message in bytes
# this is only limited by the program listening on the /dev/log Unix
# socket, glibc can handle arbitrary length log messages, but -- for
# example -- syslogd accepts only 1024 bytes
# (default is 2048)
#log_msg_size(2048);
};


######
# sources

# all known message sources
source s_all {
# message generated by Syslog-NG
internal();
# standard Linux log source (this is the default place for the syslog()
# function to send logs to)
unix-stream("/dev/log");
# messages from the kernel
file("/proc/kmsg" log_prefix("kernel: "));
# use the above line if you want to receive remote UDP logging messages
# (this is equivalent to the "-r" syslogd flag)
# udp();
};


######
# destinations

# some standard log files
destination df_auth { file("/var/log/auth.log"); };
destination df_syslog { file("/var/log/syslog"); };
destination df_cron { file("/var/log/cron.log"); };
destination df_daemon { file("/var/log/daemon.log"); };
destination df_kern { file("/var/log/kern.log"); };
destination df_lpr { file("/var/log/lpr.log"); };
destination df_mail { file("/var/log/mail.log"); };
destination df_user { file("/var/log/user.log"); };
destination df_uucp { file("/var/log/uucp.log"); };

# these files are meant for the mail and news systems log files
# and provide re-usable destinations for {mail,news,...}.info,
# {mail,news,...}.notice, etc.
destination df_facility_dot_info { file("/var/log/$FACILITY.info"); };
destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); };
destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); };
destination df_facility_dot_err { file("/var/log/$FACILITY.err"); };
destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); };

# some more classical and useful files found in standard syslog configurations
destination df_debug { file("/var/log/debug"); };
destination df_messages { file("/var/log/messages"); };

# pipes
# a console to view log messages under X
destination dp_xconsole { pipe("/dev/xconsole"); };

# consoles
# this will send messages to everyone logged in
destination du_all { usertty("*"); };

# Destination für IPTABLES Log-Meldungen
destination df_firewall { file("/var/log/firewall"); };

######
# filters

# all messages from the auth and authpriv facilities
filter f_auth { facility(auth, authpriv); };

# all messages except from the auth and authpriv facilities
filter f_syslog { not facility(auth, authpriv); };

# respectively: messages from the cron, daemon, kern, lpr, mail, news, user,
# and uucp facilities
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_news { facility(news); };
filter f_user { facility(user); };
filter f_uucp { facility(uucp); };

# some filters to select messages of priority greater or equal to info, warn,
# and err
# (equivalents of syslogd's *.info, *.warn, and *.err)
filter f_at_least_info { level(info..emerg); };
filter f_at_least_notice { level(notice..emerg); };
filter f_at_least_warn { level(warn..emerg); };
filter f_at_least_err { level(err..emerg); };
filter f_at_least_crit { level(crit..emerg); };

# all messages of priority debug not coming from the auth, authpriv, news, and
# mail facilities
filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); };

# all messages of info, notice, or warn priority not coming form the auth,
# authpriv, cron, daemon, mail, and news facilities
filter f_messages {
level(info,notice,warn)
and not facility(auth,authpriv,cron,daemon,mail,news);
};

# messages with priority emerg
filter f_emerg { level(emerg); };

# complex filter for messages usually sent to the xconsole
filter f_xconsole {
facility(daemon,mail)
or level(debug,info,notice,warn)
or (facility(news)
and level(crit,err,notice));
};

#Filter für IPTABLES-Meldungen
filter f_iptables {
facility(kern) and match("REJECT UDP") or match("INPUT INVALID");
};

######
# logs
# order matters if you use "flags(final);" to mark the end of processing in a
# "log" statement

# these rules provide the same behavior as the commented original syslogd rules

#Hiermit wird verhindert, dass IPTABLES-Meldungen den kernel- bzw. message-Block gar nicht erst erreichen
log {
source(s_all);
filter(f_iptables);
destination(df_firewall);
flags(final);
};

# auth,authpriv.* /var/log/auth.log
log {
source(s_all);
filter(f_auth);
destination(df_auth);
};

# *.*;auth,authpriv.none -/var/log/syslog
log {
source(s_all);
filter(f_syslog);
destination(df_syslog);
};

# this is commented out in the default syslog.conf
# cron.* /var/log/cron.log
#log {
# source(s_all);
# filter(f_cron);
# destination(df_cron);
#};

# daemon.* -/var/log/daemon.log
log {
source(s_all);
filter(f_daemon);
destination(df_daemon);
};

# kern.* -/var/log/kern.log
log {
source(s_all);
filter(f_kern);
destination(df_kern);
};

# lpr.* -/var/log/lpr.log
log {
source(s_all);
filter(f_lpr);
destination(df_lpr);
};

# mail.* -/var/log/mail.log
log {
source(s_all);
filter(f_mail);
destination(df_mail);
};

# user.* -/var/log/user.log
log {
source(s_all);
filter(f_user);
destination(df_user);
};

# uucp.* /var/log/uucp.log
log {
source(s_all);
filter(f_uucp);
destination(df_uucp);
};

# mail.info -/var/log/mail.info
log {
source(s_all);
filter(f_mail);
filter(f_at_least_info);
destination(df_facility_dot_info);
};

# mail.warn -/var/log/mail.warn
log {
source(s_all);
filter(f_mail);
filter(f_at_least_warn);
destination(df_facility_dot_warn);
};

# mail.err /var/log/mail.err
log {
source(s_all);
filter(f_mail);
filter(f_at_least_err);
destination(df_facility_dot_err);
};

# news.crit /var/log/news/news.crit
log {
source(s_all);
filter(f_news);
filter(f_at_least_crit);
destination(df_facility_dot_crit);
};

# news.err /var/log/news/news.err
log {
source(s_all);
filter(f_news);
filter(f_at_least_err);
destination(df_facility_dot_err);
};

# news.notice /var/log/news/news.notice
log {
source(s_all);
filter(f_news);
filter(f_at_least_notice);
destination(df_facility_dot_notice);
};


# *.=debug;\
# auth,authpriv.none;\
# news.none;mail.none -/var/log/debug
log {
source(s_all);
filter(f_debug);
destination(df_debug);
};


# *.=info;*.=notice;*.=warn;\
# auth,authpriv.none;\
# cron,daemon.none;\
# mail,news.none -/var/log/messages
log {
source(s_all);
filter(f_messages);
destination(df_messages);
};

# *.emerg *
log {
source(s_all);
filter(f_emerg);
destination(du_all);
};


# daemon.*;mail.*;\
# news.crit;news.err;news.notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole
log {
source(s_all);
filter(f_xconsole);
destination(dp_xconsole);
};

Viele Grüße
Hendrik

swen1
31.01.05, 15:14
Hi,

habe das gleiche Problem. Die syslog-ng.conf ist wie oben erklärt angepasst. Also die iptables-Regeln hinzugefügt und an den Anfang verschoben. Die Meldungen erscheinen nun in /var/log/firewall und leider immernoch in /var/log/messages. Das Flag "final" scheint keine Wirkung zu haben. Auch konnte ich keine Doku oder Webseiten mit Erklärungen zu flags(); finden. Wo steht dazu was???

Danke!
Gruß Swen