• Zarejestrowany: 2012-03-28
  • Posty: 37

Temat: syslog-ng

syslog-ng zainstalowany na 1043ND co trzeba ustawić żeby nie pokazywał takiego spamu bo plik rośnie jak na drożdżach.
Na razie idą tylko logi z głównego routera a docelowo ma jeszcze logować z dekodera

podaje tylko przyklad jednej linijki

Jan 28 14:43:07 192.168.1.1 kernel: DROP IN=eth3 OUT= MAC=xxxxxxxxxxxxxxxxxxxxxxxxx SRC=xxxxxxx.144.66 DST=xxxxxxxxxx.13.152 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=20014 PROTO=TCP SPT=46685 DPT=32764 WINDOW=1024 RES=0x00 SYN URGP=0

mój config syslog-ng.conf :

@version:3.0

options {
    chain_hostnames(no);
    create_dirs(yes);
    flush_lines(0);
    keep_hostname(yes);
    log_fifo_size(256);
    log_msg_size(1024);
    stats_freq(0);
    flush_lines(0);
    use_fqdn(no);
};

source src {
    internal();
    unix-stream("/dev/log");
};

source net {
    udp(ip(192.168.1.33) port(514));
};

source kernel {
        file("/proc/kmsg" program_override("kernel"));
};

destination messages {
    file("/overlay/www/log.txt");
};

log {
    source(src);
    source(net);
        source(kernel);
    destination(messages);
};

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,595

Odp: syslog-ng

Wyłącz logowanie z firewallu.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez helmut77

  • Zarejestrowany: 2012-03-28
  • Posty: 37

Odp: syslog-ng

a jakaś podpowiedz?

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,595

Odp: syslog-ng

Prawdopodobnie masz w /etc/config/firewall ustawiony log lub zrobioną własną regułę logującą cały ruch (-j LOG)

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

5 Odpowiedź przez helmut77

  • Zarejestrowany: 2012-03-28
  • Posty: 37

Odp: syslog-ng

nic nie ustawiałem wgrałem default

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'lan'
    list network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'wan'
    list network 'wan'
    list network 'wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config include
    option src 'wan'
    option target 'ACCEPT'
    option dest_port '51413'
    option proto 'udp'
    option reload '1'
    option type 'script'
    option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
    option family 'IPv4'

config include 'miniupnpd'
    option type 'script'
    option path '/usr/share/miniupnpd/firewall.include'
    option family 'IPv4'
    option reload '1'

config include 'openvpn_include_file'
    option path '/etc/openvpn.firewall'
    option reload '1'

6 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,595

Odp: syslog-ng

iptables -v -L
iptables -v -L -t nat

pokaż

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

7 Odpowiedź przez helmut77 (edytowany przez helmut77 2015-01-28 20:37:52)

  • Zarejestrowany: 2012-03-28
  • Posty: 37

Odp: syslog-ng

root@Gargoyle:~# iptables -v -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
19633 2437K bw_ingress  all  --  br-lan any     anywhere             anywhere            
20590 2507K delegate_input  all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 bw_ingress  all  --  br-lan any     anywhere             anywhere            
    0     0 delegate_forward  all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 4497 1458K delegate_output  all  --  any    any     anywhere             anywhere            

Chain MINIUPNPD (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain bw_ingress (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0            all  --  any    any     anywhere             anywhere            bandwidth --id total1-download-2-449 --type combined --current_bandwidth 0 --reset_interval 2 --reset_time 2 --intervals_to_save 449 
    0     0            all  --  any    any     anywhere             anywhere            match-set local_addr_set dst bandwidth --id bdist1-download-minute-15 --type individual_dst --reset_interval minute --intervals_to_save 15 
    0     0            all  --  any    any     anywhere             anywhere            bandwidth --id total2-download-minute-359 --type combined --current_bandwidth 0 --reset_interval minute --intervals_to_save 359 
    0     0            all  --  any    any     anywhere             anywhere            match-set local_addr_set dst bandwidth --id bdist2-download-900-24 --type individual_dst --reset_interval 900 --reset_time 900 --intervals_to_save 24 
    0     0            all  --  any    any     anywhere             anywhere            bandwidth --id total3-download-180-479 --type combined --current_bandwidth 0 --reset_interval 180 --reset_time 180 --intervals_to_save 479 
    0     0            all  --  any    any     anywhere             anywhere            match-set local_addr_set dst bandwidth --id bdist3-download-hour-24 --type individual_dst --reset_interval hour --intervals_to_save 24 
    0     0            all  --  any    any     anywhere             anywhere            bandwidth --id total4-download-7200-359 --type combined --current_bandwidth 0 --reset_interval 7200 --reset_time 7200 --intervals_to_save 359 
    0     0            all  --  any    any     anywhere             anywhere            match-set local_addr_set dst bandwidth --id bdist4-download-day-31 --type individual_dst --reset_interval day --intervals_to_save 31 
    0     0            all  --  any    any     anywhere             anywhere            bandwidth --id total5-download-day-365 --type combined --current_bandwidth 0 --reset_interval day --intervals_to_save 365 
    0     0            all  --  any    any     anywhere             anywhere            match-set local_addr_set dst bandwidth --id bdist5-download-month-12 --type individual_dst --reset_interval month --intervals_to_save 12 

Chain delegate_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 forwarding_rule  all  --  any    any     anywhere             anywhere            /* user chain for forwarding */ 
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere            ctstate RELATED,ESTABLISHED 
    0     0 zone_lan_forward  all  --  br-lan any     anywhere             anywhere            
    0     0 reject     all  --  any    any     anywhere             anywhere            

Chain delegate_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  872 62720 ACCEPT     all  --  lo     any     anywhere             anywhere            
19718 2445K input_rule  all  --  any    any     anywhere             anywhere            /* user chain for input */ 
 2907  768K ACCEPT     all  --  any    any     anywhere             anywhere            ctstate RELATED,ESTABLISHED 
  171  8872 syn_flood  tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN 
16811 1676K zone_lan_input  all  --  br-lan any     anywhere             anywhere            

Chain delegate_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  872 62720 ACCEPT     all  --  any    lo      anywhere             anywhere            
 3625 1395K output_rule  all  --  any    any     anywhere             anywhere            /* user chain for output */ 
 3217 1365K ACCEPT     all  --  any    any     anywhere             anywhere            ctstate RELATED,ESTABLISHED 
  408 30738 zone_lan_output  all  --  any    br-lan  anywhere             anywhere            

Chain forwarding_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain forwarding_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain forwarding_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain input_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain output_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain reject (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere            reject-with tcp-reset 
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable 

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  171  8872 RETURN     tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50 
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain zone_lan_dest_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  408 30738 ACCEPT     all  --  any    br-lan  anywhere             anywhere            

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  br-lan br-lan  anywhere             anywhere            
    0     0 forwarding_lan_rule  all  --  any    any     anywhere             anywhere            /* user chain for forwarding */ 
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere            /* forwarding lan -> wan */ 
    0     0 zone_lan_src_REJECT  all  --  any    any     anywhere             anywhere            

Chain zone_lan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination         
16811 1676K input_lan_rule  all  --  any    any     anywhere             anywhere            /* user chain for input */ 
16811 1676K zone_lan_src_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_lan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  408 30738 output_lan_rule  all  --  any    any     anywhere             anywhere            /* user chain for output */ 
  408 30738 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_lan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
16811 1676K ACCEPT     all  --  br-lan any     anywhere             anywhere            

Chain zone_lan_src_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  br-lan any     anywhere             anywhere            

Chain zone_wan_dest_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain zone_wan_forward (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MINIUPNPD  all  --  any    any     anywhere             anywhere            
    0     0 forwarding_wan_rule  all  --  any    any     anywhere             anywhere            /* user chain for forwarding */ 
    0     0 zone_wan_src_REJECT  all  --  any    any     anywhere             anywhere            

Chain zone_wan_input (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 input_wan_rule  all  --  any    any     anywhere             anywhere            /* user chain for input */ 
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:bootpc /* Allow-DHCP-Renew */ 
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request /* Allow-Ping */ 
    0     0 zone_wan_src_REJECT  all  --  any    any     anywhere             anywhere            

Chain zone_wan_output (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 output_wan_rule  all  --  any    any     anywhere             anywhere            /* user chain for output */ 
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere            

Chain zone_wan_src_REJECT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
root@Gargoyle:~# 
root@Gargoyle:~# iptables -v -L -t nat
Chain PREROUTING (policy ACCEPT 33574 packets, 8901K bytes)
 pkts bytes target     prot opt in     out     source               destination         
33574 8901K delegate_prerouting  all  --  any    any     anywhere             anywhere            

Chain INPUT (policy ACCEPT 353 packets, 54888 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 851 packets, 62610 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 851 packets, 62610 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  851 62610 delegate_postrouting  all  --  any    any     anywhere             anywhere            

Chain MINIUPNPD (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain delegate_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  851 62610 postrouting_rule  all  --  any    any     anywhere             anywhere            /* user chain for postrouting */ 
  411 31002 zone_lan_postrouting  all  --  any    br-lan  anywhere             anywhere            

Chain delegate_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
33574 8901K prerouting_rule  all  --  any    any     anywhere             anywhere            /* user chain for prerouting */ 
33574 8901K zone_lan_prerouting  all  --  br-lan any     anywhere             anywhere            

Chain postrouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain postrouting_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain postrouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain prerouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain prerouting_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain prerouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain zone_lan_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  411 31002 postrouting_lan_rule  all  --  any    any     anywhere             anywhere            /* user chain for postrouting */ 

Chain zone_lan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
33574 8901K prerouting_lan_rule  all  --  any    any     anywhere             anywhere            /* user chain for prerouting */ 

Chain zone_wan_postrouting (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 postrouting_wan_rule  all  --  any    any     anywhere             anywhere            /* user chain for postrouting */ 
    0     0 MASQUERADE  all  --  any    any     anywhere             anywhere            

Chain zone_wan_prerouting (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MINIUPNPD  all  --  any    any     anywhere             anywhere            
    0     0 prerouting_wan_rule  all  --  any    any     anywhere             anywhere            /* user chain for prerouting */ 
root@Gargoyle:~#


no i zaczeło sie młody przyszedł z gimbazy wsiadł na torrenty i od razu plik rośnie 5 razy szybciej

8 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,595

Odp: syslog-ng

To nie to. Faktycznie nie ma żadnego logowania tu.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

9 Odpowiedź przez helmut77

  • Zarejestrowany: 2012-03-28
  • Posty: 37

Odp: syslog-ng

to moźe ruter zew. ciśnie spamem po porcie 514 a 1043nd przyjmuje all;   ?