/usr/share/doc/samhain/manual.html/basic-configuration.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Configuration of logging facilities</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Support / Bugs / Problems"
HREF="support.html"><LINK
REL="NEXT"
TITLE="Available logging facilities"
HREF="configfacility.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="CHAPTER"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="support.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="configfacility.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="CHAPTER"
><H1
><A
NAME="BASIC-CONFIGURATION"
></A
>Chapter 4. Configuration of logging facilities</H1
><P
>  The  configuration file for 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> is named <TT
CLASS="FILENAME"
>samhainrc</TT
>
  by default. Also by default, it is placed in 
  <TT
CLASS="FILENAME"
>/etc</TT
>.
  (Name and location is configurable at compile time).
  The distribution package comes with a commented sample 
  configuration file. The layout of the configuration file is described
  in more details in <A
HREF="the-configuration-file.html#CONFIGFILE"
>Section C.1</A
>.</P
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="LOGDEF"
>4.1. General</A
></H1
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Events</I
></SPAN
> (e.g. unauthorized modifications 
  of files monitored by <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>)
  will generate <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>messages</I
></SPAN
> of some 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>severity</I
></SPAN
>. These messages will be
  logged to all logging facilities, whose <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>threshold</I
></SPAN
> 
  is equal to, or 
  lower than, the severity of the message.</P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="SEVERITYDEF"
>4.1.1. Severity levels</A
></H2
><P
>  The following severity levels are defined:
      <DIV
CLASS="INFORMALTABLE"
><P
></P
><A
NAME="AEN999"
></A
><TABLE
BORDER="1"
FRAME="border"
CLASS="CALSTABLE"
><COL><COL><THEAD
><TR
><TH
>Level</TH
><TH
>Significance</TH
></TR
></THEAD
><TBODY
><TR
><TD
>none</TD
><TD
>Keyword to switch off a looging facility (*).</TD
></TR
><TR
><TD
>debug</TD
><TD
>Debugging-level messages.</TD
></TR
><TR
><TD
>info</TD
><TD
>Informational message.</TD
></TR
><TR
><TD
>notice</TD
><TD
>Normal conditions.</TD
></TR
><TR
><TD
>warn</TD
><TD
>Warning conditions.</TD
></TR
><TR
><TD
>mark</TD
><TD
>Timestamps.</TD
></TR
><TR
><TD
>err</TD
><TD
>Error conditions.</TD
></TR
><TR
><TD
>crit</TD
><TD
>Critical conditions.</TD
></TR
><TR
><TD
>alert</TD
><TD
>Program startup/normal exit, or fatal error, causing abnormal program termination.</TD
></TR
><TR
><TD
>inet</TD
><TD
>Incoming messages from clients (server only).</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></P
><P
>  (*) the keyword 'none' can only be used as a threshold for logging facilities,
  to indicate that no messages shall be logged via that facility.</P
><P
>  Most events (e.g. timestamps, internal errors, program startup/exit) 
  have <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>fixed</I
></SPAN
> severities. 
  The following events have <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>configurable</I
></SPAN
> severities:
  (*) the keyword 'none' can only be used as a threshold for logging facilities,
  to indicate that no messages shall be logged via that facility.</P
><P
><P
></P
><UL
><LI
><P
>(server only) failure to resolve a client address (section 
<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>[Misc]</I
></SPAN
>, option <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>SeverityLookup</I
></SPAN
>)</P
></LI
><LI
><P
>policy violations (for monitored files)</P
></LI
><LI
><P
>access errors for files</P
></LI
><LI
><P
>access errors for directories</P
></LI
><LI
><P
>obscure file names (with non-printable characters)
and/or invalid UIDs/GIDs (no such user/group)</P
></LI
><LI
><P
>login/logout events (if <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> is 
configured to monitor them)</P
></LI
></UL
></P
><P
>Severity levels for events (see <A
HREF="basic-configuration.html#SEVERITYDEF"
>Section 4.1.1</A
>&#62;) 
  are set in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>EventSeverity</I
></SPAN
> and (for login/logout
  events) the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Utmp</I
></SPAN
> sections of the configuration file.</P
><P
>  In the configuration file, these can be set as follows:</P
><PRE
CLASS="PROGRAMLISTING"
>  [EventSeverity]  
  #  
  # these are policies  
  # 
  SeverityReadOnly=crit 
  SeverityLogFiles=crit
  SeverityGrowingLogs=warn 
  SeverityIgnoreNone=crit 
  SeverityIgnoreAll=info 
  #  
  # these are access errors 
  # 
  SeverityFiles=err 
  SeverityDirs=err 
  #  
  # these are obscure file names 
  # and/or invalid UIDs/GIDs (no such user/group) 
  # 
  SeverityNames=info 
  #  
  # This is the section for login/logout monitoring 
  # 
  [Utmp]  
  SeverityLogin=notice
  SeverityLogout=notice 
  # multiple logins by same user 
  SeverityLoginMulti=err </PRE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="CLASSES"
>4.1.2. Classes</A
></H2
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Events</I
></SPAN
> of related type are grouped into 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>classes</I
></SPAN
>. For each
  logging facility, it is possible to restrict logging to a subset of
  these classes (see <A
HREF="thresholds.html"
>Section 4.3</A
>&#62;). 
  The available classes are:</P
><P
>      <DIV
CLASS="INFORMALTABLE"
><P
></P
><A
NAME="AEN1070"
></A
><TABLE
BORDER="1"
FRAME="border"
CLASS="CALSTABLE"
><COL><COL><THEAD
><TR
><TH
>Class</TH
><TH
>Significance</TH
></TR
></THEAD
><TBODY
><TR
><TD
>EVENT</TD
><TD
>Events to be reported (i.e. policy violations, login/logout).</TD
></TR
><TR
><TD
>START</TD
><TD
>Startup/stop messages.</TD
></TR
><TR
><TD
>STAMP</TD
><TD
>Timestamp (heartbeat) messages.</TD
></TR
><TR
><TD
>LOGKEY</TD
><TD
>The key to verify the signed log file.</TD
></TR
><TR
><TD
>ERROR</TD
><TD
>Error messages.</TD
></TR
><TR
><TD
>OTHER</TD
><TD
>Everything else (e.g. informational messages).</TD
></TR
><TR
><TD
>AUD</TD
><TD
>System calls (for debugging).</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></P
><P
>The aforementioned classes represent a new, simplified classification 
scheme since version 1.8.2. 
The previous scheme (listed below) will still work, and both 
can be mixed.</P
><P
>      <DIV
CLASS="INFORMALTABLE"
><P
></P
><A
NAME="AEN1100"
></A
><TABLE
BORDER="1"
FRAME="border"
CLASS="CALSTABLE"
><COL><COL><THEAD
><TR
><TH
>Class</TH
><TH
>Significance</TH
></TR
></THEAD
><TBODY
><TR
><TD
>AUD</TD
><TD
>System calls.</TD
></TR
><TR
><TD
>RUN</TD
><TD
>Normal run messages (e.g. startup, exit, ...)</TD
></TR
><TR
><TD
>STAMP</TD
><TD
>Timestamps and alike.</TD
></TR
><TR
><TD
>FIL</TD
><TD
>Messages related to file integrity checking.</TD
></TR
><TR
><TD
>TCP</TD
><TD
>Messages from the client/server subsystem.</TD
></TR
><TR
><TD
>PANIC</TD
><TD
>Fatal errors, leading to program termination.</TD
></TR
><TR
><TD
>ERR</TD
><TD
>Error messages (general).</TD
></TR
><TR
><TD
>ENET</TD
><TD
>Error messages (network).</TD
></TR
><TR
><TD
>EINPUT</TD
><TD
>Error messages (input, e.g. configuration file).</TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="EHEAD-CUSOM"
>4.1.3. Error message customization</A
></H2
><P
>It is possible to customize the initial part (the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>header</I
></SPAN
>
of messages via the 
<B
CLASS="COMMAND"
>MessageHeader=<TT
CLASS="REPLACEABLE"
><I
>"format"</I
></TT
></B
>
directive. <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Enclosing quotes are only required to protect 
leading/trailing space, and there is no need to escape quotes within 
the format string.</I
></SPAN
> The following placeholders are recognized:
  <P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>%S</DT
><DD
><P
>Severity of the message.</P
></DD
><DT
>%T</DT
><DD
><P
>Timestamp of the message.</P
></DD
><DT
>%C</DT
><DD
><P
>Class of the message.</P
></DD
><DT
>%F</DT
><DD
><P
>Source file where the message originates from.</P
></DD
><DT
>%L</DT
><DD
><P
>Line number (in the source file) where the message originates from.</P
></DD
><DT
>%E</DT
><DD
><P
>An error code that may provide additional information in case of internal errors.</P
></DD
></DL
></DIV
></P
><P
>  In the configuration file, these can be set as follows:</P
><PRE
CLASS="PROGRAMLISTING"
>[Misc]
#
# This is the default without XML
#
MessageHeader="%S %T "
#
# Default for XML-style messages.
# Note that quotes within the format strings are NOT escaped in any way.
#
# MessageHeader="&lt;log sev="%S" tstamp="%T" "</PRE
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="support.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="configfacility.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Support / Bugs / Problems</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Available logging facilities</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / basic-configuration.html
