Forum Debian Users Gang

DeWu · 2014-11-21 14:42:00

Witam

Jakiś czas temu ustawiłem swojego Debiana tak, aby zapisywał mi logi z routerów MikroTik do osobnych plików za pomocą rsyslog. Moja konfiguracja [i]/etc/rsyslog.conf[/i]

Kod:

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#            For more information see
#            /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html


#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

###########################
#### Mikrotik          ####
###########################

### for Szczaniec remote logging
$AllowedSender UDP, 10.0.34.4, 10.0.142.0/25, 192.168.0.0/24
$AllowedSender TCP, 10.0.34.4, 10.0.142.0/25, 192.168.0.0/24
$UDPServerAddress 192.168.0.20

### Zdalne
:fromhost-ip, isequal, "10.0.142.1" /var/log/MikroTik/Wioska1.log
:fromhost-ip, isequal, "10.0.34.4" /var/log/MikroTik/Wisoka2.log

### TK2 dawne
:fromhost-ip, isequal, "192.168.0.12" /var/log/MikroTik/TK2.log
:fromhost-ip, isequal, "192.168.0.21" /var/log/MikroTik/dzielnica1.log
:fromhost-ip, isequal, "192.168.0.22" /var/log/MikroTik/dzielnica2.log
:fromhost-ip, isequal, "192.168.0.23" /var/log/MikroTik/dzielnica3.1log
:fromhost-ip, isequal, "192.168.0.57" /var/log/MikroTik/mickiewicza57.log

### osiedle
:fromhost-ip, isequal, "192.168.0.36" /var/log/MikroTik/osiedle1.log
:fromhost-ip, isequal, "192.168.0.37" /var/log/MikroTik/osiedle2.log
:fromhost-ip, isequal, "192.168.0.38" /var/log/MikroTik/osiedle3.log
:fromhost-ip, isequal, "192.168.0.39" /var/log/MikroTik/osiedle4.log
:fromhost-ip, isequal, "192.168.0.11" /var/log/MikroTik/osiedle5.log
:fromhost-ip, isequal, "192.168.0.40" /var/log/MikroTik/osiedle6.log
:fromhost-ip, isequal, "192.168.0.41" /var/log/MikroTik/osiedle7.log
:fromhost-ip, isequal, "192.168.0.32" /var/log/MikroTik/osiedle8.log
:fromhost-ip, isequal, "192.168.0.43" /var/log/MikroTik/osiedle13.log
:fromhost-ip, isequal, "192.168.0.30" /var/log/MikroTik/slowianskie4.log


### Staszica
:fromhost-ip, isequal, "192.168.0.44" /var/log/MikroTik/staszica11-15.log
:fromhost-ip, isequal, "192.168.0.45" /var/log/MikroTik/staszica16-20.log


### reymonta
:fromhost-ip, isequal, "192.168.0.61" /var/log/MikroTik/reymonta1.log
:fromhost-ip, isequal, "192.168.0.62" /var/log/MikroTik/reymonta2.log
:fromhost-ip, isequal, "192.168.0.63" /var/log/MikroTik/reymonta3.log
:fromhost-ip, isequal, "192.168.0.64" /var/log/MikroTik/reymonta4.log
:fromhost-ip, isequal, "192.168.0.65" /var/log/MikroTik/reymonta5.log
:fromhost-ip, isequal, "192.168.0.66" /var/log/MikroTik/reymonta6.log
:fromhost-ip, isequal, "192.168.0.67" /var/log/MikroTik/reymonta7.log
:fromhost-ip, isequal, "192.168.0.68" /var/log/MikroTik/reymonta8.log
:fromhost-ip, isequal, "192.168.0.69" /var/log/MikroTik/reymonta9.log
:fromhost-ip, isequal, "192.168.0.60" /var/log/MikroTik/reymonta10.log
:fromhost-ip, isequal, "192.168.0.70" /var/log/MikroTik/reymonta11.log

### Miasto2
:fromhost-ip, isequal, "192.168.0.110" /var/log/MikroTik/powstancow.log
:fromhost-ip, isequal, "192.168.0.112" /var/log/MikroTik/sienkiewicza.log
:fromhost-ip, isequal, "192.168.0.113" /var/log/MikroTik/wiejska.log
:fromhost-ip, isequal, "192.168.0.114" /var/log/MikroTik/dworcowa.log

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*            /var/log/auth.log
*.*;auth,authpriv.none,local0         -/var/log/syslog
#cron.*                /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*                -/var/log/kern.log
lpr.*                -/var/log/lpr.log
mail.*                -/var/log/mail.log
user.*                -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info            -/var/log/mail.info
mail.warn            -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Logging for INN news system.
#
news.crit            /var/log/news/news.crit
news.err            /var/log/news/news.err
news.notice            -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none    -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail        -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#    news.=crit;news.=err;news.=notice;\
#    *.=debug;*.=info;\
#    *.=notice;*.=warn    /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
# 
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warn    |/dev/xconsole

Po tej zmianie tworzy pliki w /var/log/MikroTik/ jednak /var/log/syslog jest pusty. Po ostatnim restarcie prądowym (10 dni temu) plik ten w ogóle zniknął a 17-go, podejrzewam wtedy zadziałał logrotate, rsyslog się wysypał. Co muszę poprawić aby rsyslog zaczął działać prawidłowo tzn zapisywał /var/log/syslog ?

morfik · 2014-11-21 14:56:11

Ja mam regułki typu:

Kod:

if $fromhost-ip startswith "192.168.1.1" then /var/log/router.log
& stop

I działa bez problemu:

Kod:

root:~# ls -al  /var/log/router.log
-rw-r----- 1 root adm 6.5M Nov 21 14:52 /var/log/router.log

rulezdc · 2014-11-21 21:54:31

Cześć
Pierwsze co to bym przerzucił twoje reguły to pliku np

Kod:

 /etc/rsyslog.d/mikrotik.conf

aby nie zaśmiecać sobie łównego pliku, no i ładowanie reguł będzie wtedy w innym miejscu
Dwa, nie wiem po co włączasz udp i tcp, jak UDP to pamiętaj nie ma kontroli utraty pakietów
Trzy, pytanie jak masz na Mikrotikach ustawiony serwer, TCP czy UDP
Cztery, do twojego conficga dodałbym do każdej linijki wpis
:fromhost-ip, isequal, "192.168.0.114" ~

Aby dane się nie dublowaly w messages i wszystko tylko do plików hostów szło

Pozdrawiam

DeWu · 2014-11-24 10:16:48

Zrobiłm tak jak radził rulezdc, ze regułki odnosnie routerów umieściłęm w osobnym pliku a rsyslog.conf zamieniłem na rsyslog.conf.dist. Jednak musiałem mieć w nic coś skopane bo teraz owszem zapisuje sysloga ale są w nim informacje które przedtem miałem w mail.log. Nie pamiętam tylko jak to się zmieniało. Tutaj wynik [i]diff rsyslog.conf rsyslog.old.conf[/i]

Kod:

44,48d42
< # Where to place spool and state files
< #
< $WorkDirectory /var/spool/rsyslog
< 
< #
62c56
< *.*;auth,authpriv.none        -/var/log/syslog
---
> *.*;auth,authpriv.none,local0         -/var/log/syslog
94c88
<     mail,news.none        -/var/log/messages
---
>     mail        -/var/log/messages
99c93
< *.emerg                :omusrmsg:*
---
> *.emerg

morfik · 2014-11-24 19:23:14

Zamiast słać diffy to odpal rsysloga w trybie debug i czytaj co mu nie pasuje:

Kod:

To run rsyslog interactively, use "rsyslogd -n"to run it in debug mode use "rsyslogd -dn"

Time (s)	Query
0.00010	SET CHARSET latin2
0.00004	SET NAMES latin2
0.00092	SELECT u., g., o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='3.15.34.50' WHERE u.id=1
0.00065	REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '3.15.34.50', 1732307795)
0.00043	SELECT * FROM punbb_online WHERE logged<1732307495
0.00062	DELETE FROM punbb_online WHERE ident='18.119.108.233'
0.00068	DELETE FROM punbb_online WHERE ident='3.144.89.42'
0.00105	SELECT topic_id FROM punbb_posts WHERE id=279101
0.00004	SELECT id FROM punbb_posts WHERE topic_id=26712 ORDER BY posted
0.00058	SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=26712 AND t.moved_to IS NULL
0.00005	SELECT search_for, replace_with FROM punbb_censoring
0.00656	SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=26712 ORDER BY p.id LIMIT 0,25
0.00428	UPDATE punbb_topics SET num_views=num_views+1 WHERE id=26712
Total query time: 0.016 s

Forum Debian Users Gang

Ogłoszenie

#1 2014-11-21 14:42:00

DeWu - Użytkownik

rsyslog nie zapisuje loga

Kod:

#2 2014-11-21 14:56:11

morfik - Cenzor wirtualnego świata

Re: rsyslog nie zapisuje loga

Kod:

Kod:

#3 2014-11-21 21:54:31

rulezdc - Członek DUG

Re: rsyslog nie zapisuje loga

Kod:

#4 2014-11-24 10:16:48

DeWu - Użytkownik

Re: rsyslog nie zapisuje loga

Kod:

#5 2014-11-24 19:23:14

morfik - Cenzor wirtualnego świata

Re: rsyslog nie zapisuje loga

Kod:

Stopka forum

Informacje debugowania