/usr/share/doc/samhain/manual.html/thresholds.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Activating logging facilities and filtering messages</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuration of logging facilities"
HREF="basic-configuration.html"><LINK
REL="PREVIOUS"
TITLE="Available logging facilities"
HREF="configfacility.html"><LINK
REL="NEXT"
TITLE="E-mail"
HREF="configuration-email.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="configfacility.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 4. Configuration of logging facilities</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="configuration-email.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="THRESHOLDS"
>4.3. Activating logging facilities and filtering messages</A
></H1
><P
>  All messages have a <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>severity</I
></SPAN
> level (see
  <A
HREF="basic-configuration.html#SEVERITYDEF"
>Section 4.1.1</A
>&#62;) and a 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>class</I
></SPAN
> (see <A
HREF="basic-configuration.html#CLASSES"
>Section 4.1.2</A
>&#62;), 
  with somewhat orthogonal meaning:</P
><P
>  The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>severity</I
></SPAN
> ranks messages with respect to their
  importance. Most events (e.g. timestamps, internal errors, 
  program startup/exit) have <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>fixed</I
></SPAN
> severities.
  However, as importance sometimes is a matter of taste, some 
  events have <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>configurable</I
></SPAN
> severities (see
  <A
HREF="basic-configuration.html#LOGDEF"
>Section 4.1</A
>&#62;).</P
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Classes</I
></SPAN
> refer to the purpose/category of a message.
  As such, they should (ideally) be useful to exclude messages that
  are not interesting in some context (e.g. startup/stop messages may
  seem useless noise if samhain is run from cron).</P
><P
>  Obviously, as <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>severity</I
></SPAN
> is a rank, the most
  natural way to exclude unwanted messages is to set a 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>threshold</I
></SPAN
>. On the other hand, as the
  message <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>class</I
></SPAN
> is a category, the most natural
  way to exclude messages is to <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>list</I
></SPAN
> those
  message classes that you want.</P
><P
>  Messages are only logged to a log facility if their severity is at least
  as high as the threshold of that facility, and their class is one of
  those wanted (by default: all).
  Thresholds and class lists 
  can be specified individually for each facility. </P
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Switching on/off</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  Most log facilities are <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>off by default</I
></SPAN
>, and
  need to be enabled by setting an appropriate threshold.
  </P
><P
>  A threshold of <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>none</I
></SPAN
> switches off 
  the respective facility. 
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Logging of client messages by the server</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  By default, messages received by the server are treated specially,
  and are always logged to the logfile, and never to mail or syslog.
  If you don't like that, use the option 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>UseClientSeverity=yes</I
></SPAN
>
  (section <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>[Misc]</I
></SPAN
>).
  </P
></TD
></TR
></TABLE
></DIV
><P
>  Thresholds and class lists are set in the 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Log</I
></SPAN
> section of 
  the configuration file.
  For each threshold option 
  <B
CLASS="COMMAND"
><TT
CLASS="REPLACEABLE"
><I
>Facility</I
></TT
>Severity</B
> there 
  is also a
  corresponding option 
  <B
CLASS="COMMAND"
><TT
CLASS="REPLACEABLE"
><I
>Facility</I
></TT
>Class</B
>
  to limit that facility
  to messages within a given set of class. The argument must be a list
  of valid message classes, separated by space or comma. </P
><P
>  Actually, the 
  <B
CLASS="COMMAND"
><TT
CLASS="REPLACEABLE"
><I
>Facility</I
></TT
>Severity</B
>
  can take a list of severities with optional specifiers 
  '*', '!', or '=', which are interpreted as 'all', 'excluding', and 'only', 
  respectively. Examples: specifying '*' is equal to specify 'debug';
  specifying '!*' is equal to specifying 'none'; 
  'info,!crit' is the range from 'info' to 'err' (excluding crit and above); 
  and 'info,!=err' is
  info and above, but excluding (only) 'err'. This is the same scheme as
  used by the Linux syslogd (see man 5 syslogd). 
 </P
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>System calls:</I
></SPAN
> certain system 
  calls (execve, utime, unlink, 
	dup (+ dup2), chdir, open, kill, 
	exit (+ _exit), fork, setuid, setgid, pipe)
  can be logged (only to console and syslog). You can determine the set of
  system calls to log via the option 
  <B
CLASS="COMMAND"
>LogCalls=<TT
CLASS="REPLACEABLE"
><I
>call1, call2, ...</I
></TT
></B
>.
  By default, this is off (nothing is logged). 
  The priority is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>notice</I
></SPAN
>, and the class is AUD.</P
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Example:</I
></SPAN
></P
><PRE
CLASS="PROGRAMLISTING"
>  [Log]  
  #  
  # Threshold for E-mails (none = switched off)
  # 
  MailSeverity=none  
  #  
  # Threshold for log file 
  # 
  LogSeverity=err 
  LogClass=RUN FIL STAMP 
  #  
  # Threshold for console 
  # 
  PrintSeverity=info
  #  
  # Threshold for syslog (none = switched off)
  # 
  SyslogSeverity=none 
  #  
  # Threshold for logging to Prelude (none = switched off)
  # 
  PreludeSeverity=none 
  #  
  # Threshold for forwarding to the log server
  # 
  ExportSeverity=crit 
  #  
  # Threshold for invoking an external program
  # 
  ExternalSeverity=crit
  #  
  # Threshold for logging to a SQL database
  # 
  DatabaseSeverity=err
  #  
  # System calls to log
  # 
  LogCalls=open, kill</PRE
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="configfacility.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="configuration-email.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Available logging facilities</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="basic-configuration.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>E-mail</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / thresholds.html
