PDA

View Full Version : Syslog-NG



John_Gill
10-Nov-2014, 15:43
Hi,

Running SLES11sp3 and have enabled syslog-ng.

I am trying to log everything from my Cisco ASA (firewall) to my new syslog server.
I have fiddled a bit, and I am getting messages into various files in /var/log....so far so good.

What I really want is for all the CiscoASA messages to go into one file under /var/log/ciscoasa and then have logrotate
zip the files every week and then rotate this every 3 months. I assume that the usual server logging
will continue as normal.

As usual, any suggestions, comments etc will be appreciated.
Regards
John

ab
10-Nov-2014, 16:07
Can you post a sample of your cisco-sourced events? Filtering is pretty
neat in syslog-ng. Another customer tried to do some filtering before,
and this may at least get you started:

https://forums.suse.com/showthread.php?4148-syslog-ng-and-filter

Another post from the Internet with a filtering example:

http://www.syslog.org/forum/syslog-ng/syslog-ng-filter-using-match%28%29-and-value/

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...

John_Gill
11-Nov-2014, 10:31
Hi ab,

Below are some samples of the log files in /var/log/localmessages and /var/log/messages coming from the Cisco ASA 10.1.2.1 to my syslog server 10.1.3.42

I am not too concerned about splitting the data into separate logfiles just so long as "logrotate" will zip the file(s) on a weekly basis and store them for 3 to 6 months.

*********************
*** localmessages ***
*********************
Nov 11 08:10:46 10.1.2.1 %ASA-7-713906: IKE Receiver: Packet received on 10.5.1.2:4500 from 41.13.146.205:46452
Nov 11 08:10:46 10.1.2.1 %ASA-7-713236: IP = 41.13.146.205, IKE_DECODE RECEIVED Message (msgid=d2b4a40a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Nov 11 08:10:46 10.1.2.1 %ASA-7-715047: Group = cor-ballito-tg, Username = cor_ballito_3G, IP = 41.13.146.205, processing hash payload
Nov 11 08:10:46 10.1.2.1 %ASA-7-715047: Group = cor-ballito-tg, Username = cor_ballito_3G, IP = 41.13.146.205, processing notify payload
Nov 11 08:10:46 10.1.2.1 %ASA-7-715075: Group = cor-ballito-tg, Username = cor_ballito_3G, IP = 41.13.146.205, Received keep-alive of type DPD R-U-THERE (seq number 0x1c8d7e5d)
Nov 11 08:10:46 10.1.2.1 %ASA-7-715036: Group = cor-ballito-tg, Username = cor_ballito_3G, IP = 41.13.146.205, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x1c8d7e5d)
Nov 11 08:10:46 10.1.2.1 %ASA-7-715046: Group = cor-ballito-tg, Username = cor_ballito_3G, IP = 41.13.146.205, constructing blank hash payload
Nov 11 08:10:46 10.1.2.1 %ASA-7-715046: Group = cor-ballito-tg, Username = cor_ballito_3G, IP = 41.13.146.205, constructing qm hash payload
Nov 11 08:10:46 10.1.2.1 %ASA-7-713236: IP = 41.13.146.205, IKE_DECODE SENDING Message (msgid=8f359a6f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Nov 11 08:10:47 10.1.2.1 %ASA-5-304001: 10.6.5.23 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/css/JSGrid.css
Nov 11 08:10:47 10.1.2.1 %ASA-5-304001: 10.6.5.23 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/css/RI.css
Nov 11 08:10:47 10.1.2.1 %ASA-7-710007: NAT-T keepalive received from 197.87.79.42/4500 to outside:10.5.1.2/4500
Nov 11 08:10:47 10.1.2.1 %ASA-7-710007: NAT-T keepalive received from 41.13.76.85/54060 to outside:10.5.1.2/4500
Nov 11 08:10:47 10.1.2.1 %ASA-5-304001: 10.1.3.15 Accessed URL ZScaler: http://osce11-ilspn30-p.activeupdate.trendmicro.com:80/activeupdate/pattern/itbldiff_1463000200_1463000300.zip
**********
*** EOF ***
**********

**************
*** messages ***
**************
Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleleft_dis.png
Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleleft_ena.png
Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/share/images/welcome/shuttleright_dis.png
Nov 11 08:13:44 10.1.2.1 %ASA-7-609002: Teardown local-host outside:197.78.204.107 duration 1:12:07
Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/share/images/welcome/splittervc.png
Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/share/images/welcome/splittervc_ovr.png
Nov 11 08:13:44 10.1.2.1 %ASA-5-304001: 10.6.2.22 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/share/images/small-go.gif
Nov 11 08:22:52 10.1.2.1 %ASA-7-715075: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, Received keep-alive of type DPD R-U-THERE (seq number 0x163513d9)
Nov 11 08:22:52 10.1.2.1 %ASA-7-715036: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x163513d9)
Nov 11 08:22:52 10.1.2.1 %ASA-7-715046: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, constructing blank hash payload
Nov 11 08:22:52 10.1.2.1 %ASA-7-715046: Group = corobrik-vpn, Username = tcm, IP = 197.87.79.42, constructing qm hash payload
Nov 11 08:22:52 10.1.2.1 %ASA-7-713236: IP = 197.87.79.42, IKE_DECODE SENDING Message (msgid=25aad8a6) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.17.95 Accessed URL 10.1.3.5:http://10.1.3.5/proxy.pac
Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.24.93 Accessed URL 10.1.3.5:http://10.1.3.5/proxy.pac
Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.8.24 Accessed URL jde1:http://jde1.corobrik.co.za/jde/ResourceCanonicalsJS.mafService?e1.namespace=&e1.service=ResourceCanonicalsJS&RENDER_MAFLET=E1Menu&e1.state=maximized&e1.mode=view
Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.8.24 Accessed URL jde1:http://jde1.corobrik.co.za/jde/js/dropdownMenuItem.js
Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.16.97 Accessed URL webmail1:http://webmail1.corobrik.co.za/gw/webacc?User.context=17dcd7f699bfec2d3f236482ba7a4a 69f4b7f790&action=Folder.List&merge=jfolders&forcedUpdate=1415687173280
Nov 11 08:22:52 10.1.2.1 %ASA-5-304001: 10.6.5.23 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/css/RI.css
Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.10.26 Accessed URL 10.1.3.5:http://10.1.3.5/proxy.pac
Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.10.26 Accessed URL 10.1.3.5:http://10.1.3.5/proxy.pac
Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.22.21 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/css/calendar.css
Nov 11 08:22:53 10.1.2.1 %ASA-5-304001: 10.6.22.21 Accessed URL 10.1.3.54:http://jde2.corobrik.co.za/jde/css/SidePanel.css
**********
*** EOF ***
**********

Regards
John

ab
11-Nov-2014, 13:39
Wildly guessing, try adding these to the syslog-ng configuration file,
then restart the syslog-ng service:

[CODE]
destination d_ciscoasa { file("/var/log/ciscoasa"); };

filter f_ciscoasa { match('^ASA-:'); };

log { source(src); filter(f_ciscoasa); destination(d_ciscoasa); };
[CODE]

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...

jmozdzen
11-Nov-2014, 18:16
Hi John,

I am not too concerned about splitting the data into separate logfiles just so long as "logrotate" will zip the file(s) on a weekly basis and store them for 3 to 6 months.

this then is covered in logrotate's configuration.

See /etc/logrotate.d/syslog for a sample - if you manage to put these messages in a separate log file (see i.e. ab's reply), then create a new file in /etc/logrotate.d, where you will set up the rotation similar to the entries in /etc/logrotate.d/syslog.

If you want weekly rotation, use "weekly" instead of maxage:

weekly Log files are rotated if the current weekday is less than the weekday of the last rotation or if more than a week has passed since the last rotation. This is normally the same as rotating logs on the first day of the
week, but it works better if logrotate is not run every night.

If you want to keep the files for half a year, set "rotate" to 26: Keeping 26 weekly files covers about 6 months.

Compression is controlled via "compress" and "compresscmd". And keep the "postrotate" block, so that syslogd gets restarted. For everything else, see "man logrotate" ;)

Regards,
Jens

jmozdzen
11-Nov-2014, 18:30
Hi *,

another option would be to filter one the message source:

filter f_ciscooasa { host("10.1.2.1"); );

One thing to look out for is if the IP suddenly resolves to a name - then the filter would have to be adjusted (add another condition "... or host( "somenameforASAbox")..." ).

Regards,
Jens

John_Gill
12-Nov-2014, 08:08
Hi ab and jmozdzen,

Thanks for the information, it has been a great help.

I fiddled a bit more and now I am capturing the logs from the Cisco firewall. I will have to see if the logrotate is working.

The only issue is that the files /var/log/messages and localmessages are also getting the log entries.
Can this be turned off so that the Cisco firewall logs only go to the ciscoasa.log file, otherwise the data is duplicated/triplicated.

Regards
John

jmozdzen
12-Nov-2014, 11:04
Hi John,

> The only issue is that the files /var/log/messages and localmessages are also getting the log entries.

You can change that by adding the inverse filter to the "standard" syslog log entries (those writing to /var/log/messages and localmessages).

Regards,
Jens