Syslog-NG 설치 및 설정

목표 : 모든 서버의 SYSLOG를 로그 서버로 쏘게 하고, 로그서버에서는 HOST-yyyymmdd.log 를 만들어 관리하도록 설정.
Syslog-NG(Syslog New Generation)는 보다 향상된 필터링 및 포워딩 기능 외에 메시지 무결성과 암호화 기능을 추가하여 syslog의 유연성을 증가시켰으며, TCP와 UDP 프로토콜을 통한 원격 Logging을 지원합니다.
안정성에 있어서도 좋은 평가를 받고 있으며, 게다가 고급 보안 기능들은 아직까지도 업데이트중에 있지만, 원격호스트로부터 받는 메시지를 인증하고 암호화하는 기능은 SSL Wrapper인 Stunnel와 ssh와 같은 TCP 터널링 도구와 함께 사용될 수도 있습니다.

1. libol 설치

]# tar xvzf libol-0.3.18.tar.gz
]# cd libol-0.3.18
]# ./configure
checking for cl... no
configure: error: no acceptable C compiler found in $PATH
See `config.log' for more details.

]# tar xvzf libol-0.3.18.tar.gz

]# cd libol-0.3.18

]# ./configure

checking for cl... no

configure: error: no acceptable C compiler found in $PATH

See `config.log' for more details.

헐.. gcc 설치..

]# yum install gcc

1	]# yum install gcc

libol 설치 재시도

]# ./configure
checking how to run the C++ preprocessor... /lib/cpp
configure: error: C++ preprocessor "/lib/cpp" fails sanity check
See `config.log' for more details.

]# ./configure

checking how to run the C++ preprocessor... /lib/cpp

configure: error: C++ preprocessor "/lib/cpp" fails sanity check

See `config.log' for more details.

gcc-c++, glibc-devel도 설치

]# yum install gcc-c++ glibc-devel

1	]# yum install gcc-c++ glibc-devel

libol 설치 성공!!

]# ./configure
...
]# make; make install

]# ./configure

...

]# make; make install

2. eventlog 설치

]# tar xvzf eventlog_0.2.12.tar.gz
]# cd eventlog_0.2.12
]# ./configure
]# make; make install

]# tar xvzf eventlog_0.2.12.tar.gz

]# cd eventlog_0.2.12

]# ./configure

]# make; make install

3. libnet 설치

]# wget http://www.sfr-fresh.com/unix/privat/libnet-1.1.2.1.tar.gz
]# tar xvzf libnet-1.1.6.tar.gz
]# cd libnet-1.1.6
]# ./configure
]# make; make install

]# wget http://www.sfr-fresh.com/unix/privat/libnet-1.1.2.1.tar.gz

]# tar xvzf libnet-1.1.6.tar.gz

]# cd libnet-1.1.6

]# ./configure

]# make; make install

4. syslog-ng 설치

]# tar xvzf syslog-ng_3.2.4.tar.gz
]# cd syslog-ng-3.2.4/
]# export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig

]# ./configure --prefix=/etc/syslog-ng
...
checking whether to enable SQL support... no
checking for GLIB... no
configure: error: Package requirements (glib-2.0 >= 2.10.1 gmodule-2.0) were not met:

No package 'glib-2.0' found
No package 'gmodule-2.0' found

Consider adjusting the PKG_CONFIG_PATH environment variable if you
installed software in a non-standard prefix.

Alternatively, you may set the environment variables GLIB_CFLAGS
and GLIB_LIBS to avoid the need to call pkg-config.
See the pkg-config man page for more details.

No package 'glib-2.0' found
No package 'gmodule-2.0' found

]# tar xvzf syslog-ng_3.2.4.tar.gz

]# cd syslog-ng-3.2.4/

]# export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig

]# ./configure --prefix=/etc/syslog-ng

...

checking whether to enable SQL support... no

checking for GLIB... no

configure: error: Package requirements (glib-2.0 >= 2.10.1 gmodule-2.0) were not met:

No package 'glib-2.0' found

No package 'gmodule-2.0' found

Consider adjusting the PKG_CONFIG_PATH environment variable if you

installed software in a non-standard prefix.

Alternatively, you may set the environment variables GLIB_CFLAGS

and GLIB_LIBS to avoid the need to call pkg-config.

See the pkg-config man page for more details.

No package 'glib-2.0' found

No package 'gmodule-2.0' found

흐미 또 error… glib2.x86_64, glib2-devel.x86_64 설치후 재시도

]# yum install glib2.x86_64 glib2-devel.x86_64

1	]# yum install glib2.x86_64 glib2-devel.x86_64

]# ./configure --prefix=/etc/syslog-ng
]# make; make install

1 2	]# ./configure --prefix=/etc/syslog-ng ]# make; make install

2. 설정

syslog-ng.conf 파일은 options{}, source{}, destination{}, filter{}, log{} 문으로 구성

options{} 은 말그대로 옵션이므로 생략

time_reopen : 재실행시 대기 시간
log_fifo_size : output큐를 라인수에 맞추는 크기
long_hostnames : 긴 호스트네임을 그대로 쓸것인지 아닌지 설정 on/off로 지정
use_dns : dns쿼리를 사용할 것인지 아닌지 설정 yes/no로 지정(no지정된 DOS(서비스 거부 공격)에 막아낼수 있게 된다.)
use_fqdn : 호스트네임을 사요할 것인지 아니면 전체 도메인을 사용할 것인지 설정
create_dirs : destination파일을 위한 디렉토리 생성 여부를 설정 (yes/no)

source{} 는 어디서 부터 로그를 받을 것인지 설정할 수 있다.
fifo/pipe, file, internal, sun-streams, tcp/udp, usertty, unix-dgram 등이 올 수 있다.

예)

source s_dgram
{ unix-dgram("/dev/log"); };

source s_internal
{ internal(); };

source s_kernel
{ pipe("/proc/kmsg" log_prefix("kernel: ")); };

source s_tcp
{ tcp(port(4800) keep-alive(yes) max_connections(100)); };

source s_dgram

{ unix-dgram("/dev/log"); };

source s_internal

{ internal(); };

source s_kernel

{ pipe("/proc/kmsg" log_prefix("kernel: ")); };

source s_tcp

{ tcp(port(4800) keep-alive(yes) max_connections(100)); };

destination{} 는 로그를 어떻게 보낼(저장할) 것인가를 설정할 수 있다.
fifo/pipe, file, program, tcp/udp, unix-stream(unix-dgram) 등이 올 수 있다.

예)

destination authlog        { file("/var/log/auth.log"); };
destination bootlog        { file("/var/log/boot.log"); };
destination debug          { file("/var/log/debug"); };
destination secure         { file("/var/log/secure"); };
destination user           { file("/var/log/user.log"); };

destination hosts          { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };

destination loghost       { udp("10.1.1.254" port(514)); };

destination users          { usertty("*"); };

destination swatch         { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); };

destination database       { pipe("/tmp/mysql.pipe"
template("INSERT INTO logs (host, facility,
priority, level, tag, date, time, program,
msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY',
'$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY',
'$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n")
template-escape(yes)); };

destination authlog { file("/var/log/auth.log"); };

destination bootlog { file("/var/log/boot.log"); };

destination debug { file("/var/log/debug"); };

destination secure { file("/var/log/secure"); };

destination user { file("/var/log/user.log"); };

destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };

destination loghost { udp("10.1.1.254" port(514)); };

destination users { usertty("*"); };

destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); };

destination database { pipe("/tmp/mysql.pipe"

template("INSERT INTO logs (host, facility,

priority, level, tag, date, time, program,

msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY',

'$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY',

'$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n")

template-escape(yes)); };

filter{}는 여러가지 함수를 실행할 수 있다. 보통 로그 기록을 필터링하게 된다.
facility() : facility중 일치하는 로그를 가져오는 함수
facility의 값 : auth, authpriv, cron, daemon, kern, lpr, mail, news, syslog, user, uucp, local0 – local7

level()/priority() : level/priority중 일치하는 로그를 가져오는 함수.
level/priority의 값 : (엄격도가 감소하는 순서) debug, info, notice, warning, warn (same as warning),err, error (same as err), crit, alert, emerg, panic (same as emerg)

host(regexp)

match()

program(regexp)

예 )

filter      f_authpriv     { facility(authpriv); };
filter      f_daemon       { facility(daemon); };
filter      f_auth         { facility(auth, authpriv); };
filter      f_spooler      { facility(uucp,news) and level(crit); };
filter      f_syslog       { not facility(auth, authpriv) and not facility(mail); };
filter      f_emergency    { level(emerg); };
filter      f_err          { level(err); };

filter f_test1 {
host("syslogdb") and
facility(cron) and
level(info)
};

filter f_test2 {
facility(auth) and
level(info) and
match("su oracle") and
match(" succeeded for root on /dev/")
};

filter f_postgres { not(
(host("syslogdb") and facility(cron) and level(info))
or (facility(user) and level(notice)
and ( match(" gethostbyaddr: ")
or match("last message repeated ")
)
)
or ( facility(local3) and level(notice)
and match(" SYSMON NORMAL "))
or ( facility(mail) and level(warning)
and match(" writable directory")
)
or (  ( host("dbserv1.somecompany.com")
or host("dbserv2.somecompany.com")
)
and facility(auth) and level(info)
and match("su oracle") and match(" succeeded for root on /dev/")
)
); };

filter f_authpriv { facility(authpriv); };

filter f_daemon { facility(daemon); };

filter f_auth { facility(auth, authpriv); };

filter f_spooler { facility(uucp,news) and level(crit); };

filter f_syslog { not facility(auth, authpriv) and not facility(mail); };

filter f_emergency { level(emerg); };

filter f_err { level(err); };

filter f_test1 {

host("syslogdb") and

facility(cron) and

level(info)

};

filter f_test2 {

facility(auth) and

level(info) and

match("su oracle") and

match(" succeeded for root on /dev/")

};

filter f_postgres { not(

(host("syslogdb") and facility(cron) and level(info))

or (facility(user) and level(notice)

and ( match(" gethostbyaddr: ")

or match("last message repeated ")

)

or ( facility(local3) and level(notice)

and match(" SYSMON NORMAL "))

or ( facility(mail) and level(warning)

and match(" writable directory")

)

or ( ( host("dbserv1.somecompany.com")

or host("dbserv2.somecompany.com")

)

and facility(auth) and level(info)

and match("su oracle") and match(" succeeded for root on /dev/")

)

); };

log{} 는 지정된 source를 filter를 적용해 destination을 실행한다.

예)

log { source(s_tcp); destination(message); };

log { source(s_internal); source(s_tcp); destination(loghost); };

log { source(s_dgram);
source(s_internal);
source(s_tcp);      filter(f_auth);      destination(authlog); };

log { source(s_dgram);
source(s_internal);
source(s_tcp);      filter(f_mail);
filter(f_err);       destination(mailerr); };

log { source(s_tcp); destination(message); };

log { source(s_internal); source(s_tcp); destination(loghost); };

log { source(s_dgram);

source(s_internal);

source(s_tcp); filter(f_auth); destination(authlog); };

log { source(s_dgram);

source(s_internal);

source(s_tcp); filter(f_mail);

filter(f_err); destination(mailerr); };

udp 514으로 들어오는 로그를 host-yymmdd.log 으로 저장하고,
로그에 HACK 이 들어있는 로그는 따로 필터해서 hack-host-yymmdd.log 에 저장하도록 설정

options {
flush_lines (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (on);
use_dns (no);
use_fqdn (yes);
create_dirs (yes);
keep_hostname (yes);
};

source LOG_ZONE  {
udp(port(514));
};

destination destfile {
file("/logs/$HOST-$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0600));
};

log {
source(LOG_ZONE);
destination(destfile);
};

filter f_hack {
match("HACK");
};

destination destfile_filtered {
file("/logs/hack-$HOST-$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0600));
};

log {
source(LOG_ZONE);
filter(f_hack);
destination(destfile_filtered);
};

options {

flush_lines (0);

time_reopen (10);

log_fifo_size (1000);

long_hostnames (on);

use_dns (no);

use_fqdn (yes);

create_dirs (yes);

keep_hostname (yes);

};

source LOG_ZONE {

udp(port(514));

};

destination destfile {

file("/logs/$HOST-$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0600));

};

log {

source(LOG_ZONE);

destination(destfile);

};

filter f_hack {

match("HACK");

};

destination destfile_filtered {

file("/logs/hack-$HOST-$YEAR$MONTH$DAY.log" owner(root) group(root) perm(0600));

};

log {

source(LOG_ZONE);

filter(f_hack);

destination(destfile_filtered);

};

참고

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch05_:_Troubleshooting_Linux_with_syslog
http://www.campin.net/syslog-ng/expanded-syslog-ng.conf
http://www.jjangu.pe.kr/blog/522
http://kltp.kldp.net/stories.php?story=04/02/12/9073427

Apollo89.com

아폴로씨의 잡다한 경험들..

Syslog-NG 설치 및 설정

댓글 남기기응답 취소

카테고리

최신 댓글

메타