EPSIAE » eneraptor

h1. Archive and statistics

{{toc}}

TBD - to be discussed

TODO - to do :)

Tole sem pustil zaenkrat not, da lahko hitro najdem stvari, ki jih moram se dopolnit oziroma jih moramo se predebatirat. V koncni verziji se bom teh kratic znebil in tudi tega komentarja v slovenscini :)

h2. 1 Basic concept

TODO Why syslog

p. Eneraptor is designed in a way that it could communicate with any device regardless of its operating system. Syslog, system for logging program messages offers a quick and easy solutions for such communications, because it allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them.

TODO malo nerodno zapisano?

h3. 1.1 Hardware

p. We will be using syslog-ng (syslog from now on), which has a few advantages over conventional syslog. Most basic setup , originator - collector, suits our needs just fine so far, but it can also be extended in the future. Syslog daemon (collector) will run on proxy server, syslog client (originator) will run on FRI-SMS system.

TBD collector will be listening to a certain port (5140 - most commonly used) for incoming messages from client(s).

Client mode operation:

!https://lusy.fri.uni-lj.si/redmine/attachments/11/client_server_syslog.png!

p. In client mode, syslog-ng collects the local logs generated by the host and forwards them through a network connection to the central syslog-ng server. Clients can also log the messages locally into files.

TODO more details on syslog-ng advantages over conventional syslog?

h3. 1.2 Syslog message format

TODO Mogoce tega sploh ne bo treba vedet, program()

TBD TCP/IP vs UDP

TBD How do we plan to send messages to our daemon, via client (not always possible) or do we generate them ourselves?

TBD Using logfiles vs logging into database

h3. 1.3 Development steps

# Installing and configuring Syslog-ng daemon on proxy

# Installing and configuring Syslog-ng client on FRI-SMS

# TBD Designing Statistical Data Analysis Software to work with data collected by syslog daemon

# TBD Implementing SDA software

# TBD Testing?

h2. 2 Installing and configuring syslog-ng daemon on proxy

p. Syslog-ng supports wide variety of Operating Systems so we aren't really restricted here. Since our proxy and FRI-SMS both run Linux 2.6 our obvious choce is syslog-ng for Linux.

h3. 2.1 syslog-ng daemon on proxy

Configuration file location:

/opt/syslog-ng/etc/syslog-ng.conf

Basic syslog configuration:

<pre><code class="ruby">

@version: 3.2

#Default configuration file for syslog-ng.

#

# For a description of syslog-ng configuration file directives, please read

# the syslog-ng Administrator's guide at:

#

# http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html

#

options {

		time_reap(30);

		mark_freq(10);

		keep_hostname(yes);

	};

######

# sources

source s_local {

	# message generated by Syslog-NG

	internal();

	# standard Linux log source (this is the default place for the syslog()

	# function to send logs to)

	unix-stream("/dev/log");

	# messages from the kernel

	file("/proc/kmsg" program_override("kernel"));

};

# source s_syslog { syslog(ip(127.0.0.1) port(1999) transport("tcp")); };

########################

# Filters

########################

# Here's come the filter options. With this rules, we can set which 

# message go where.

# messages for eneraptor should have priority level LOG_MAIL and contain keyword "eneraptor"

filter f_mail_eneraptor { facility(mail) and match("eneraptor"); };

######

# destinations

destination d_messages        { file("/var/log/messages"); };

destination filtered_messages { file("/var/log/messages_filtered"); };

#

# SQL logging support

#

destination d_pgsql {

  sql(type(pgsql)

  host("127.0.0.1") port(5432) username("eneraptor") password("eneraptor")

  database("eneraptordb")

  table("logs")

  columns("datetime varchar(16)", "host varchar(32)", "program varchar(80)", "pid varchar(80)", "message varchar(200)")

  values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSG")

  indexes("datetime", "host", "program", "pid", "message"));

};

log {

source(s_local);

destination(d_messages);

# destination(d_pgsql);

};

log {

source(s_local);

filter(f_mail_eneraptor);

destination(filtered_messages);

destination(d_pgsql);

};

</code></pre>

h3. 2.2 syslogd configuration on FRI-SMS

Edit <pre>/etc/inittab</pre> - change:

<code><pre>

null::respawn:/sbin/syslogd -n -m 0

</code></pre>

to

<code><pre>

null::respawn:/sbin/syslogd -n -m 0 -R 192.168.10.1

</code></pre>

where <pre>192.168.10.1</pre> is the IP of the server running syslog-ng. Finally, 

have init reload it's configuration by running:

<code><pre>

kill -1 1

</code></pre>

syslog-ng restart command:

<pre><code>/etc/init.d/syslog-ng restart

</code></pre>

h2. Statistical Data Analysis Software

TODO

h2. References

"Syslog protocol, RFC 5424":http://tools.ietf.org/html/rfc5424

"Syslog-ng homepage":http://www.balabit.com/network-security/syslog-ng

"Syslog-ng administrator guide":http://www.balabit.com/support/documentation/syslog-ng-ibm-agent-guide-admin-en.pdf