Syslog is a standard login (service) information from
network devices (router, pix), Unix hosts,
printers ...
Events can be logged either locally or remotely on the syslog host .
Syslog allows the separation of applications, operating systems .. from the host on which the logged events are stored.
This is a very useful feature because it can be for example:
- In case of system failure to check the smooth running of the event was preceded by a host crash
- In many hardware solutions, there is no enough place for store logging events. If you have configured syslog, it is not problem behavior logs over the years
- Syslog is also very useful in case of intrusion, both external, internal and if necessary
use of logged data such as in court.
Syslog installation is not difficult. Possibly a little more difficult to configure the log distribution (arrangement) for each day of the month, year .. but we can handle this.
Stages of installation (configure logging for pix'a cisco).
1. Will do the installation on Debian (a Linux operating system).
- Start with the updates (you do not have to do it;)
aptitude update
aptitude upgrade
- Install syslog-ng
aptitude install syslog-ng
- Install openssl stunnel
aptitude install openssl stunnel
- After installation, edit the configuration file
nano /etc/syslog-ng/syslog-ng.conf and at the end add:
source net { udp(ip(0.0.0.0) port(514)); }; #0.0.0.0 will allow all hosts to send their logs to your host.
destination d_cisco { file("/var/log/cisco/$YEAR.$MONTH.$DAY/cisco.log"); };
filter f_cisco_info { level(info); };
filter f_cisco_notice { level(notice); };
filter f_cisco_warn { level(warn); };
filter f_cisco_crit { level(crit); };
filter f_cisco_err { level(err); };
filter f_cisco_debug { level(debug); };
log { source(net); filter(f_cisco_info); destination(d_cisco); };
log { source(net); filter(f_cisco_notice); destination(d_cisco); };
log { source(net); filter(f_cisco_warn); destination(d_cisco); };
log { source(net); filter(f_cisco_crit); destination(d_cisco); };
log { source(net); filter(f_cisco_err); destination(d_cisco); };
log { source(net); filter(f_cisco_debug); destination(d_cisco); };
- Thanks to this we were able to configure the syslog (in a simplified way), so that port 514 (syslog port official) receive the information logged.
- We can restart our syslog
/etc/ init.d/syslog-ng stop
/etc/init.d/syslog-ng start
- We can configure the login for our device. For example, if your syslog host address is 192.168.1.100 in this example, Cisco pix type command:
- Enable logging:
logging host inside 192.168.1.100
so briefly, of course we have to choose the login detail, or interface
- We can preview our current log
tail /var/log/cisco/(current date)/cisco.log
- Login now works, but as it usually is, not every day we look for logged events. Sometimes it can be a very
long time, during which our logs will grow to exorbitant size of a directory structure to expand beautifully;)
To avoid this, install logrotate and introduce a little order into our system.
- aptitude install logrotate
logrotate is a program dealing with log rotation
- Edit configuration
nano /etc/ logrotate.conf
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
# system-specific logs may be configured here
- To start logrotate type (force start)
logrotate -f
- If we want rotate only syslog then you would run
logrotate -f /etc/logrotate.d/syslog-ng
That's all, our logon service works. Of course, your configuration may be significantly more sophisticated.