Iptables logging to diferent file via syslog-ng

syslog-ng

I have the following configuration in my iptables and syslog files:

IPTABLES

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 222 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT

-A INPUT -j DROP

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

SYSLOG-NG

destination d_iptables { file("/var/log/iptables/iptables.log"); };

filter f_iptables { facility(kern) and match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); };

filter f_messages { level(info,notice,warn) and
                    not facility(auth,authpriv,cron,daemon,mail,news) and not 
filter(f_iptables); };

log { source(s_src); filter(f_iptables); destination(d_iptables); };`

I restart syslog-ng and the log is not written.

Best Answer

Your syslog-ng config appears fine to me but your iptables config isn't. The -j LOG line appears after a line that DROPs everything, hence it will never be reached.

You should move the LOG line to directly before whatever event you want to log. If you want to log everything, put it first. If you want to log everything that isn't ACCEPTed, put it after all the ACCEPTs.

Related Solutions

Linux – Filter out a facility in syslog-ng

I got the answer.

We can create filters using the filter keyword:

filter <filtername> { expression; };

Where expression is a simple boolean expression. You can use "and", "or" and "not" to connect builtin functions. Functions can be one of:

facility(list of comma seperated facility names)
level(list of comma seperated priority nammes OR a range separated by "..")
program(regexp to match program name)
host(regexp to match program name)
match(regexp to match program name)

So, if we want to add our own program, for example "pm", to the filter use it like this:

filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron) and program(pm); };

And if we want to filter out the log messages of "pm", use the filter like this :

filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron) and not program(pm); };

Syslog-ng unable to capture syslog from ASA

In the past I have opted to quote IP addresses as part of the host section of a filter string. So using this as an example you should make the following changes:

filter f_covad { (host("10.253.99.150") or host("10.253.99.1")); };

Otherwise I see nothing wrong with your config. Next you should check your host firewall to see if UDP port 514 is open from your log sources. Next after that is seeing if the logs are even making it that far. What I often like to do for testing reception of syslog traffic is to simply use tcpdump. It will parse the message and display the appropriate data. For example:

packs@ node1:~> sudo tcpdump -i eth0 port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:53:35.633091 IP remote.host.local.47007 > node1.local.syslog: SYSLOG user.info, length: 688
13:53:35.646322 IP remote.host.local.47007 > node1.local.syslog: SYSLOG local5.info, length: 204
13:53:35.654178 IP remote.host.local.47007 > node1.local.syslog: SYSLOG local5.info, length: 204

This gives us all the information we need to see if the messages are even getting to the host.

Best Answer

Related Solutions

Linux – Filter out a facility in syslog-ng

Syslog-ng unable to capture syslog from ASA

Related Topic