/usr/share/doc/samhain/manual.html/logmon.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Logfile monitoring/analysis</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring samhain, the host integrity monitor"
HREF="file-monitor.html"><LINK
REL="PREVIOUS"
TITLE="Checking for open ports"
HREF="portcheck.html"><LINK
REL="NEXT"
TITLE="Checking the Windows registry"
HREF="winreg.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="portcheck.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 5. Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="winreg.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="LOGMON"
>5.16. Logfile monitoring/analysis</A
></H1
><P
>  This option is available with <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> version
  2.5.0 and higher. To compile with support for this option, use the 
  configure option 
  </P
><P
>  <B
CLASS="COMMAND"
>./configure --enable-logfile-monitor</B
>
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>PCRE library required</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    This option requires the PCRE (Perl Compatible Regular Expressions)
    library. Many Linux distributions split library packages into a
    runtime package (required to run a dependent executable) and a
    development package (required to compile an executable). At least
    on the build host where <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> is
    compiled, the development package is required if you use this option.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  This module enables <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> to 
  monitor/analyze
  logfiles of other applications. Currently 
  (<SPAN
CLASS="APPLICATION"
>samhain</SPAN
> 2.5.0) the following
  logfile formats are supported:
  <P
></P
><UL
><LI
><P
>	 Syslog
	 </P
></LI
><LI
><P
>	 Apache (access and error log)
	 </P
></LI
><LI
><P
>	 Samba
	 </P
></LI
><LI
><P
>	 'pacct' BSD-style process accounting (also available on Linux)
	 </P
></LI
></UL
>
  </P
><P
>    Logfile analysis will always start from the point the last one
    ended; the pointer into the file is stored persistently on disk.
    Logfile rotation is handled automatically as long as the rotated
    logfile remains in the same directory and is 
    <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not compressed</I
></SPAN
> (usually log rotation tools
    can be configured to compress only after the second rotation,
    which is advisable for unrelated reasons - the logging application
    may still have an open file pointer after logfile rotation).
  </P
><P
>    Logfile entries can be filtered with Perl-style 
    regular expressions (filter rules). Regular expressions must
    match <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>the whole logfile record</I
></SPAN
>.
    For efficiency, regular expressions can be grouped under a common
    regular expression, i.e. if the group expression fails to match,
    no RE in the group is tried. Furthermore, (groups of) regular expressions
    can be grouped by host, if the logfile(s) contain host information
    (such as host information in centralized syslog server logfiles, 
    or virtual host information in Apache logfiles). Note that
    host-&gt;group-&gt;rule is supported (just as host-&gt;rule or
    group-&gt;rule), while group-&gt;host-&gt;rule
    isn't.
  </P
><P
>    Each filtering rule (regular expression) is assigned to an output
    queue. Currently (<SPAN
CLASS="APPLICATION"
>samhain</SPAN
> 2.5.0) queues
    only differ in the assigned severity of an event, but more options
    (per-queue mail addresses for alerts) are under development.
  </P
><P
>   Filtering rules are processed in the order given in the configuration 
   file, i.e. the first match wins.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Blacklisting vs. whitelisting, and the 'trash' output queue</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    Output queues are labelled. The label 'trash' is reserved and
    refers to the trash bin (no output, throw away log entries
    if the matching rule is assigned to the 'trash' queue).
  </P
><P
>    If a logfile entry does not match any rule, it is reported
    (i.e. the default is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>whitelisting</I
></SPAN
> known-good
    entries). To
    turn this into a <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>blacklisting</I
></SPAN
> policy, simply
    add a catch-all rule at the end and assign it to the 'trash' queue.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN2855"
>5.16.1. Event Correlation</A
></H2
><P
>    Sometimes it is desirable to report on the fact that several events
    happend at a similar time, possibly in a particular order. As of
    version 2.6.1, <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> supports this in the
    following way:
  </P
><DIV
CLASS="SECT3"
><H3
CLASS="SECT3"
><A
NAME="AEN2859"
>5.16.1.1. Marking individual events to be correlated</A
></H3
><P
>    First, individual events to be correlated need to be marked for
    keeping them, under an arbitrary user-defined label, for an arbitrary
    user-defined time. So the rule for matching an event has to be
    modified like this:
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=KEEP(<TT
CLASS="REPLACEABLE"
><I
>seconds,label</I
></TT
>):<TT
CLASS="REPLACEABLE"
><I
>queue_label</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
>
  matches a logfile entry against the provided regular expression, AND keeps
  it for the specified time in <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>seconds</I
></SPAN
>, with the specified
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>label</I
></SPAN
>. In other words, processing of this rule will
  be no different than other rules, except for the fact that also a memory of 
  the event is kept for the specified amount of time. So if you e.g. don't 
  want a separate report for this individual event, just assign it to
  the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>trash</I
></SPAN
> queue.
  </P
></DIV
><DIV
CLASS="SECT3"
><H3
CLASS="SECT3"
><A
NAME="AEN2870"
>5.16.1.2. Correlating the marked events</A
></H3
><P
>    To correlate events labelled <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>label_one</I
></SPAN
>, 
    <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>label_two</I
></SPAN
>, etc., just build a regular expression 
    that matches the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>labels</I
></SPAN
>, in the temporal order 
    you want to check for. E.g. if the temporal order is irrelevant, you 
    may want to match 
    <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>(label_one.*label_two)|(label_two.*label_one)</I
></SPAN
>.
    Use this expression in a rule maked as 
    CORRELATE(<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>description</I
></SPAN
>), like this:
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=CORRELATE(<TT
CLASS="REPLACEABLE"
><I
>description</I
></TT
>):<TT
CLASS="REPLACEABLE"
><I
>queue_label</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
>
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Old records in existing logfiles</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    Because the 'keep' timeout is relative to the current time, correlation
    of old entries in logfiles (i.e. when, at startup, an existing logfile
    with old entries is scanned) will only work if you specify 'keep' 
    timeouts that are long enough to cover the whole timespan from the 
    first logfile record until now.
  </P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN2886"
>5.16.2. Reporting non-occurence of an event</A
></H2
><P
>    To check whether a given event occurs at least once within some
    given interval, the rule for matching an event can be modified
    like this:
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=MARK(<TT
CLASS="REPLACEABLE"
><I
>seconds,description</I
></TT
>):<TT
CLASS="REPLACEABLE"
><I
>queue_label</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
>
  matches a logfile entry against the provided regular expression, AND 
  checks whether is occurs at least once within the specified interval 
  (seconds).
  </P
><P
>  Processing of this rule will
  be no different than other rules otherwise, so if you e.g. only 
  want a report for this event if it is missing, just assign it to
  the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>trash</I
></SPAN
> queue. However, in the latter case
  the severity for reporting the messages must be set separately
  with the LogmonMarkSeverity directive, because the 'trash' queue
  has no severity assigned:
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonMarkSeverity=<TT
CLASS="REPLACEABLE"
><I
>severity</I
></TT
></B
>  &mdash; Severity for reports on missing heartbeat messages if the messages themselves are assigned to the 'trash' queue (default: crit).
  </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN2899"
>5.16.3. Reporting bursts of similar, repeated events</A
></H2
><P
>    <SPAN
CLASS="APPLICATION"
>Samhain</SPAN
> can automatically detect and report
    bursts of similar, repeated events in the monitored logfiles. Here
    <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>similar, repeated events</I
></SPAN
> refers to events that
    differ (only) in details that can be expected to differ for
    events of the same kind: IP adresses, FQDNs, email adresses, and numbers.
    The event history goes back 12 minutes, and
    thus a report is triggered if the number of similar events within the last 
    12 minutes exceeds a given threshold (default: 24).
  </P
><P
>    This feature is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>off</I
></SPAN
> by default. In order to
    switch it on, you need to set a reporting queue:
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonBurstQueue=<TT
CLASS="REPLACEABLE"
><I
>queue</I
></TT
></B
>  &mdash; Set the reporting queue for reporting bursts of similar log messages (default: don't report).
  </P
><P
>    In addition, there are two more configurable parameters, one to
    set the triggering threshold (i.e. the number of messages within
    12 minutes that need to be exceeded to raise an alert), and another
    one to indicate whether messages from the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>cron</I
></SPAN
>
    daemon should be considered as well (default: no):
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonBurstThreshold=<TT
CLASS="REPLACEABLE"
><I
>number</I
></TT
></B
>  &mdash; The number of repeated messages within 12 minutes that must be exceeded to report a burst of repeated messages (default: 24).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonBurstCron=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
>  &mdash; Whether to report also on bursts of repeated cron messages (default: false).
  </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN2917"
>5.16.4. Options</A
></H2
><P
>  <B
CLASS="COMMAND"
>LogmonActive=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
> switches
  this module on or off (default: off).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonSaveDir=<TT
CLASS="REPLACEABLE"
><I
>/absolute/path</I
></TT
></B
> 
  sets the directory where checkpoint data for logfiles is stored (default: 
  same as for database file).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonClean=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
> 
  delete old checkpoint data unmodified for 30 days or more (default: off). 
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonInterval=<TT
CLASS="REPLACEABLE"
><I
>seconds</I
></TT
></B
> sets the
  interval for logfile checking (default: 10 seconds).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonMarkSeverity=<TT
CLASS="REPLACEABLE"
><I
>severity</I
></TT
></B
>  &mdash; Severity for reports on missing heartbeat messages if the messages themselves are assigned to the 'trash' queue (default: crit).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonBurstThreshold=<TT
CLASS="REPLACEABLE"
><I
>number</I
></TT
></B
>  &mdash; The number of repeated messages within 12 minutes that must be exceeded to report a burst of repeated messages (default: 24).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonBurstQueue=<TT
CLASS="REPLACEABLE"
><I
>queue</I
></TT
></B
>  &mdash; Set the reporting queue for reporting bursts of similar log messages (default: don't report).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonBurstCron=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
>  &mdash; Whether to report also on bursts of repeated cron messages (defaul: false).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonDeadtime=<TT
CLASS="REPLACEABLE"
><I
>seconds</I
></TT
></B
>  &mdash; Do not report a correlated event again within the given time (default: 60 seconds).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonWatch=<TT
CLASS="REPLACEABLE"
><I
>TYPE:path[:format]</I
></TT
></B
> 
  advises the module to monitor the logfile with the specified <TT
CLASS="FILENAME"
>path</TT
>,
  which is of type 'TYPE' (logfile types are uppercase). 
  Some logfile types (e.g. Apache access logs) can be
  customized, and hence some <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>format</I
></SPAN
> information must 
  be provided.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Do not quote the format</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>      Please note that it's neither required nor supported to add
      quotes around the format string. Likewise, quotes within the format
      should not be escaped. Wrong:
    </P
><P
>      <B
CLASS="COMMAND"
>LogmonWatch=<TT
CLASS="REPLACEABLE"
><I
>APACHE:/var/log/apache/access.log:"%h %l %u %t \"%r\" %&#62;s %b \"%{Referer}i\""</I
></TT
></B
>
    </P
><P
>      Correct:
    </P
><P
>      <B
CLASS="COMMAND"
>LogmonWatch=<TT
CLASS="REPLACEABLE"
><I
>APACHE:/var/log/apache/access.log:%h %l %u %t "%r" %&#62;s %b "%{Referer}i"</I
></TT
></B
>
    </P
></TD
></TR
></TABLE
></DIV
><P
>  Currently
  (<SPAN
CLASS="APPLICATION"
>samhain</SPAN
> 2.6.4) the following 
  logfile types are supported
  <P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>SYSLOG</DT
><DD
><P
>     Standard UNIX style syslog files. Matching starts at the command (i.e. after
     the hostname). To select certain hostnames, place the rule under a LogmonHost
     directive (see below). If the LogmonHidePID option is used, the RE should not
     account for the process PID.
     </P
></DD
><DT
>APACHE</DT
><DD
><P
>     Apache (or compatible) webserver access and/or error logs. Required 
     <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>format</I
></SPAN
> information: either one 
     of <TT
CLASS="REPLACEABLE"
><I
>combined</I
></TT
>,
     <TT
CLASS="REPLACEABLE"
><I
>common</I
></TT
>, or <TT
CLASS="REPLACEABLE"
><I
>error</I
></TT
>
     (error log), or the Apache custom log format specification used (also
     '%{X-Forwarded-For}i' is recognized). The
     whole log line is matched. If there are virtual hosts (%v), then
     the LogmonHost directive will match the virtual host.
     </P
><P
>       In addition to the <SPAN
CLASS="APPLICATION"
>Apache</SPAN
> format
       specifications, is possible to insert a 
       <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>literal regular expression</I
></SPAN
> as 
       <B
CLASS="COMMAND"
>RE{<TT
CLASS="REPLACEABLE"
><I
>regex</I
></TT
>}</B
> (<SPAN
CLASS="APPLICATION"
>samhain</SPAN
> 2.8.4+).
     </P
></DD
><DT
>SAMBA</DT
><DD
><P
>     Samba logfile format (multiline, timestamp and origin within samba source code
     on first line, log message on continuation lines). The RE will match the
     continuation line (with the log message) only.
     </P
></DD
><DT
>PACCT</DT
><DD
><P
>     BSD style process accounting (also available on Linux). This is a binary
     logfile. The module will build a text line like the 'last' command does,
     and match it against the RE.
     </P
><P
>     <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>What is pacct good for?</I
></SPAN
> Note that pacct records 
     contain only the executable name, not the arguments.
     This may look somewhat useless for shell accounts, but is quite useful
     for servers: how many different commands can e.g. <SPAN
CLASS="APPLICATION"
>postfix</SPAN
>
     legitimately execute? Just a handful, indeed, and certainly none of them
     is /bin/sh! So if pacct says that the 'postfix' user has executed a shell, then
     this would be rather alarming...
     </P
></DD
><DT
>SHELL</DT
><DD
><P
>     A shell command. The full output on stdout will be read and matched. The PATH
     environment variable will be set to <TT
CLASS="REPLACEABLE"
><I
>/sbin:/bin:/usr/sbin:/usr/bin:/usr/ucb</I
></TT
>,
     and the SHELL, IFS, and TZ variables will be defined. The command is executed
     via <B
CLASS="COMMAND"
>/bin/sh -c <TT
CLASS="REPLACEABLE"
><I
>command</I
></TT
></B
>.
     </P
></DD
></DL
></DIV
>
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonHidePID=<TT
CLASS="REPLACEABLE"
><I
>boolean</I
></TT
></B
> is an option
  that only affects logfiles of type SYSLOG. It causes the PID to be stripped
  from the log line (before matching against the RE).
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonQueue=<TT
CLASS="REPLACEABLE"
><I
>label:[interval]:(sum|report):severity[:alias]</I
></TT
></B
> 
  defines an output queue. Here, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>label</I
></SPAN
> is an arbitrary 
  name which is used to assign rules to this queue; 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>interval</I
></SPAN
> is the timespan over
  which messages are summarized if the queue is of type 'sum'; 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>sum</I
></SPAN
> (summarize over some interval) or
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>report</I
></SPAN
> (report each event seperately and immediately) 
  are the two
  queue type supported, and <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>severity</I
></SPAN
> is the severity 
  assigned to an event. Furthermore, optionally it is possible to
  specify an <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>alias</I
></SPAN
> (must be defined in the email
  configuration) to direct email for this rule to a specific list
  of recipients.
  </P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Email</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    If you spefify a list alias, email will still go to all defined
    email recipients unless filtered, e.g. with
  </P
><PRE
CLASS="PROGRAMLISTING"
>    SetMailFilterNot = \[Logfile\]
  </PRE
><P
>    I.e. you may want to define recipients, filter them as above, and
    then define list aliases to be used in an event queue. See
    <A
HREF="configuration-email.html"
>Section 4.4</A
>&#62; for more information.
  </P
></TD
></TR
></TABLE
></DIV
><P
>  <B
CLASS="COMMAND"
>LogmonHost=<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
> causes
  the following rules to be applied only to entries for this host(s). It is ended
  implicitely by another LogmonHost directive, or explicitely by a LogmonEndHost
  directive.
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonEndHost</B
> explicitely ends a preceding LogmonHost
  directive.
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonGroup=<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
> causes
  the following rules to be applied only if the group regex matches (i.e. rules
  within the group are skipped if the group regex doesn't match. This can be used
  to improve speed/efficiency of matching, i.e. you can group regexes by a common
  prefix. A group is ended
  implicitely by another LogmonGroup directive, or explicitely by a LogmonEndGroup
  directive.
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonEndGroup</B
> explicitely ends a preceding LogmonGroup
  directive. 
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=<TT
CLASS="REPLACEABLE"
><I
>queue_label:(perl)regex</I
></TT
></B
>
  matches a logfile entry against the provided regular expression. If the expression
  matches, then <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>captured</I
></SPAN
> subexpressions are replaced 
  by '___', and the logfile entry is reported as specified for the queue referenced 
  by <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>queue_label</I
></SPAN
>. Non-captured subexpressions (i.e.
  subexpressions where the opening bracket is followed by '?:') are 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not replaced</I
></SPAN
> by '___', but reported literally.
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=KEEP(<TT
CLASS="REPLACEABLE"
><I
>seconds,label</I
></TT
>):<TT
CLASS="REPLACEABLE"
><I
>queue_label:(perl)regex</I
></TT
></B
>
  as above, but additionally keep the event <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>label</I
></SPAN
> for 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>seconds</I
></SPAN
> to perform event correlation.
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=CORRELATE(<TT
CLASS="REPLACEABLE"
><I
>description</I
></TT
>):<TT
CLASS="REPLACEABLE"
><I
>queue_label</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
> perform 
  event correlation by matching the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>labels</I
></SPAN
> (as specified 
  in KEEP rules) of a sequence of events against the given regular expression.
  </P
><P
>  <B
CLASS="COMMAND"
>LogmonRule=MARK(<TT
CLASS="REPLACEABLE"
><I
>seconds,description</I
></TT
>):<TT
CLASS="REPLACEABLE"
><I
>queue_label</I
></TT
>:<TT
CLASS="REPLACEABLE"
><I
>(perl)regex</I
></TT
></B
>
  matches a logfile entry against the provided regular expression, AND 
  checks whether is occurs at least once within the specified interval 
  (seconds).
  </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN3051"
>5.16.5. Example configuration</A
></H2
><PRE
CLASS="PROGRAMLISTING"
>  [Logmon]

  #
  # Switch on the module
  #
  LogmonActive = yes

  # Check every second
  #
  LogmonInterval = 1

  # Strip PIDs from syslog messages
  #
  Logmonhidepid = true

  # Define a queue with severity 'crit'.
  # This is a 'report' queue, hence 'interval' (10)
  # will be ignored.
  #
  LogmonQueue = q1:10:report:crit

  # Define a second queue with severity 'alert'
  # 
  LogmonQueue = q2:10:report:alert

  # Monitor /var/log/messages, which is a syslog file
  #
  LogmonWatch = SYSLOG:/var/log/messages

  # Monitor /var/log/samba/log.nmbd, which is a samba
  # logfile
  #
  LogmonWatch = SAMBA:/var/log/samba/log.nmbd

  # Monitor /var/log/apache2/access.log, which is
  # an Apache logfile in 'combined' format
  #
  LogmonWatch = APACHE:/var/log/apache2/access.log:combined

  # Monitor disks to check for full /dev/sda1
  #
  LogmonWatch = SHELL:df -h

  # Syslog messages for the pppd deamon
  #
  LogmonGroup = g1:pppd.*
    #
    # Rules in this group
    #
    LogmonRule     = q1:pppd:\s+primary.*
    LogmonRule     = q1:pppd:\s+secondary.*
 #
 LogmonEndGroup

 # Warn about disk /dev/sda1 nearly full (80% or more. Use a 
 # non-capturing subexpression [the (?:8|9)] for the percentage full.
 #
 LogmonRule     = q1:/dev/sda1\s+[0-9GM.]+\s+[0-9GM.]+\s+[0-9GM.]+\s+(?:8|9).%.*

 # Messages starting with WARNING (some samba stuff)
 #
 LogmonGroup = g2:WARNING.*
   LogmonRule     = q2:.*interfaces.*
 LogmonEndGroup

 # Report on these events if happening within 120 seconds.
 # Set LogmonDeadtime to 120 seconds to avoid multiple reports.
 # Use the 'trash' queue for the keep rules to avoid reports on
 #   the individual events.
 #
 LogmonRule = KEEP(120,event1):trash:sshd: Accepted publickey for root.*
 LogmonRule = KEEP(120,event2):trash:sshd: pam_unix\(sshd:session\).*
 LogmonRule = CORRELATE(root_login):q1:(event1.*event2)|(event2.*event1)

 LogmonDeadtime = 120

 # Throw away all non-matching entries. This amounts
 # to a blacklist policy (only report known bad).
 #
 # Usually considered bad practice!!! Use whitelisting!
 #
 # 'trash' is a built in queue, no definition needed.
 #
 LogmonRule = trash:.*

  </PRE
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="portcheck.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="winreg.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Checking for open ports</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="file-monitor.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Checking the Windows registry</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / logmon.html
