iptablelog-users — Support, Discussions, User oriented

Re: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php

[Stephen D. <ste...@gm...>]

Michael Brown always brings his "A" game. I agree, your best bet is to run=
=20
the feed_db.pl script in a console and see what it spits out at you.If it=
=20
says nothing then the problem is most likely that there is nothing in=20
/var/log/iptables. Therefore you need to check that iptables is indeed=20
logging to /var/log/iptables. You only provided one piece of the puzzle wit=
h=20
your config. Are you sure your iptables script is logging correctly? Is you=
r=20
logging daemon setup correctly to log iptable messages to /var/log/iptables=
?=20
You said "Everything has been setup correct" but I don't think you can say=
=20
such a thing with confidence when it doesn't provide the results you want. =
I=20
suppose I am just rambling. When in doubt follow Michael Browns advice.
 Stephen G Dailey

 On 7/18/05, Brown, Michael D <Mic...@fn...> wrote:=20
>=20
> Tail your log /var/log/iptables and make sure it is being populated with
> iptables output.
>=20
> Run the script Feed-db.pl manually, you should see output scroll across
> the screen.
>=20
> The --background is broken on newer linux installations (newer than
> RH9), so use & when you want to fork it, "Feed-db.pl&"
>=20
> Thanks,
> Michael Brown,
>=20
>=20
> -----Original Message-----
> From: ipt...@li...
> [mailto:ipt...@li...] On Behalf Of Johan
> Koen
> Sent: Monday, July 18, 2005 4:26 AM
> To: Ipt...@li...
> Subject: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php
>=20
> Hi All
>=20
> Please help with this one as I have been struggling for a week.
>=20
> Everyting has been setup up correct but when I run feed-db.pl it's just
>=20
> sitting there doing nothing!?!
> Can I set it up to log or give me some output?
>=20
>=20
> Here is the script that came with the Installation which I have modified
> to
> work on my current system.
>=20
>=20
> #!/usr/bin/perl
>=20
> use strict;
> use DBI;
> use POSIX qw(strftime);
>=20
> # IPTable log analyzer
> # Copyright (C) 2002 Gerald GARCIA
> #
> # This program is free software; you can redistribute it and/or
> # modify it under the terms of the GNU General Public License
> # as published by the Free Software Foundation; either version 2
> # of the License, or (at your option) any later version.
> #
> # This program is distributed in the hope that it will be useful,
> # but WITHOUT ANY WARRANTY; without even the implied warranty of
> # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> # GNU General Public License for more details.
> #
> # You should have received a copy of the GNU General Public License
> # along with this program; if not, write to the Free Software
> # Foundation, Inc., 59 Temple Plac<B2>e - Suite 330, Boston, MA
> 02111-1307,
> USA.
> #
> # Contact author : ge...@ge...
>=20
> # $Id: feed_db.pl,v 1.8 2002/11/12 20:43:18 gege Exp $
>=20
> use Socket;
>=20
>=20
> ########################################################################
> ##############################
> ################# C O N F I G S E C T I O N
> ###################################
> ########################################################################
> ##############################
>=20
> my $dsn =3D 'DBI:mysql:iptables:localhost';
> my $db_user_name =3D 'root';
> my $db_password =3D '';
> my $log_file =3D '/var/log/iptables';
> my $pid_file =3D "/var/run/iptablelog.pid";
>=20
> ########################################################################
> ##############################
> ################# E N D O F C O N F I G S E C T I O N
>=20
> ###########################
> ########################################################################
> ##############################
>=20
>=20
> my $go_to_background=3D($ARGV[0] eq '--background');
>=20
> $SIG{INT} =3D \&got_int;
>=20
> my ($id, $password);
> my $dbh =3D DBI->connect($dsn, $db_user_name, $db_password);
>=20
>=20
> # get the short name of months according to the locale
> # thanks to Bill Garrett <memesis at users.sourceforge.net<http://users.s=
ourceforge.net>
> >
> my(%m);
> my($month_nb);
> for $month_nb (0..11) {
> $m{strftime("%b", 0, 0, 0, 1, $month_nb,
> 96)}=3Dsprintf("%02d",$month_nb+1);
> }
>=20
> my($key);
> foreach $key (keys %m) {
> print $key,"-",$m{$key},"\n";
> }
>=20
>=20
> my($log_tag)=3D"IPTABLES";
>=20
> open(LOG_FILE,"tail -f $log_file 2>/dev/null |") or die "Unable to open
> log
> file $log_file : $!\n";
>=20
>=20
> #fork to background
> if ($go_to_background) {
> my($f) =3D fork();
> if (!defined($f)) { die "Unable to fork : $!\n"; }
> if($f) {
> # parent
> open(PID, ">$pid_file") or die "Unable to create pid file $pid_file:
> $!";
> print PID "$f\n";
> close PID;
> exit(0);
> } else {
> # child
> close STDIN;
> open(STDIN, '</dev/null');
> close STDOUT;
> open(STDOUT, '>/dev/null');
> close STDERR;
> open(STDERR, '>/dev/null');
> }
> }
>=20
>=20
>=20
> while (<LOG_FILE>) {
> if (!/$log_tag/) { next; }
> my(@entry_split)=3Dsplit / +/;
> my(%entry);
>=20
> #year is not in syslog date format... try to guess it from the local
> time
> # ***TODO*** what happen when the year change ?
> my($year);
> (undef,undef,undef,undef,undef,$year,undef,undef,undef) =3D
> localtime(time);
> $year +=3D 1900;
>=20
>=20
> $entry{'date'}=3D"$year-".$m{shift(@entry_split)}."-".shift(@entry_split)=
.
> "
> ".shift(@entry_split);
> $entry{'host'}=3Dshift(@entry_split);
>=20
> shift(@entry_split); # kernel:
>=20
> shift(@entry_split); # [IPTABLES
>=20
> my($chain_name)=3Dshift(@entry_split); # DROP]
> $chain_name=3D~s/\]//;
>=20
> shift(@entry_split); # :
> foreach (@entry_split) {
> if (/(.*)=3D(.*)/) {
> (my($field),my($value))=3Dsplit /=3D/;
> $entry{$field}=3D$value;
> }
> }
> my($iaddr) =3D inet_aton($entry{'SRC'});
> my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
> if (defined($host_name)) { $entry{"SRC_NAME"}=3D$host_name; } else
> { $entry{"SRC_NAME"}=3D"unknown"; }
>=20
> open(HOST,"host $entry{'SRC'} |");
> my($result)=3D<HOST>;
> if ($result=3D~s/Name: (.*)$/$1/) {
> $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
> } else {
> if ($result=3D~s/.* pointer (.*)\.$/$1/) {
> $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
> } else { $entry{"SRC_NAME"}=3D"unknown"; }
> }
> close(HOST);
>=20
> my($iaddr) =3D inet_aton($entry{'DST'});
> my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
> if (defined($host_name)) { $entry{"DST_NAME"}=3D$host_name; } else
> { $entry{"DST_NAME"}=3D"unknown"; }
>=20
> open(HOST,"host $entry{'DST'} |");
> my($result)=3D<HOST>;
> if ($result=3D~s/Name: (.*)$/$1/) {
> $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
> } else {
> if ($result=3D~s/.* pointer (.*)\.$/$1/) {
> $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
> } else { $entry{"DST_NAME"}=3D"unknown"; }
> }
>=20
> close(HOST);
>=20
>=20
> my($dummy)=3D"'".$entry{"host"}."','".$entry{"date"}."','".$chain_name."'=
,
> '".
> $entry{'IN'}."','".$entry{'SRC'}."','".$entry{'SRC_NAME'}."','".
> $entry{'DST'}."','".$entry{'DST_NAME'}."','".$entry{'PROTO'}."','".
> $entry{'SPT'}."','".$entry{'DPT'}."'";
>=20
> print "$dummy\n";
>=20
>=20
> $dbh->do("insert into logs
> (host,date,chain,interface_in, ip_src, name_src, ip_dest,
> name_dest, proto, port_src, port_dest) values ($dummy)");
>=20
>=20
> }
> $dbh->disconnect();
>=20
> sub got_int {
> $SIG{INT} =3D \&got_int; # but not for SIGCHLD!
> close(LOG_FILE);
> }
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id=16492&opclick
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>

RE: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php

[Brown, M. D <Mic...@fn...>]

Tail your log /var/log/iptables and make sure it is being populated with
iptables output.

Run the script Feed-db.pl manually, you should see output scroll across
the screen.

The --background is broken on newer linux installations (newer than
RH9), so use & when you want to fork it, "Feed-db.pl&"

Thanks,
Michael Brown,=20


-----Original Message-----
From: ipt...@li...
[mailto:ipt...@li...] On Behalf Of Johan
Koen
Sent: Monday, July 18, 2005 4:26 AM
To: Ipt...@li...
Subject: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php

Hi All=20

Please help with this one as I have been struggling for a week.=20

Everyting has been setup up correct but when I run feed-db.pl  it's just

sitting there doing nothing!?!=20
Can I set it up to log or give me some output?


Here is the script that came with the Installation which I have modified
to=20
work on my current system.=20

=20
 #!/usr/bin/perl

use strict;
use DBI;
use POSIX qw(strftime);

# IPTable log analyzer
# Copyright (C) 2002 Gerald GARCIA
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Plac<B2>e - Suite 330, Boston, MA
02111-1307,=20
USA.
#
# Contact author : ge...@ge...

# $Id: feed_db.pl,v 1.8 2002/11/12 20:43:18 gege Exp $

use Socket;


########################################################################
##############################
#################        C O N F I G     S E C T I O N            =20
###################################
########################################################################
##############################

my $dsn =3D 'DBI:mysql:iptables:localhost';
my $db_user_name =3D 'root';
my $db_password =3D '';
my $log_file =3D '/var/log/iptables';
my $pid_file =3D "/var/run/iptablelog.pid";

########################################################################
##############################
#################        E N D   O F   C O N F I G     S E C T I O N

###########################
########################################################################
##############################


my $go_to_background=3D($ARGV[0] eq '--background');

$SIG{INT} =3D \&got_int;

my ($id, $password);
my $dbh =3D DBI->connect($dsn, $db_user_name, $db_password);


# get the short name of months according to the locale
# thanks to Bill Garrett <memesis at users.sourceforge.net>
my(%m);
my($month_nb);
for $month_nb (0..11) {
    $m{strftime("%b", 0, 0, 0, 1, $month_nb,
96)}=3Dsprintf("%02d",$month_nb+1);
}

my($key);
foreach $key (keys %m) {
  print $key,"-",$m{$key},"\n";
}


my($log_tag)=3D"IPTABLES";

open(LOG_FILE,"tail -f $log_file 2>/dev/null |") or die "Unable to open
log=20
file $log_file : $!\n";


#fork to background
if ($go_to_background) {
  my($f) =3D fork();
  if (!defined($f)) { die "Unable to fork : $!\n"; }
  if($f) {
    # parent
    open(PID, ">$pid_file") or die "Unable to create pid file $pid_file:
$!";
    print PID "$f\n";
    close PID;
    exit(0);
  } else {
    # child
    close STDIN;
    open(STDIN, '</dev/null');
    close STDOUT;
    open(STDOUT, '>/dev/null');
    close STDERR;
    open(STDERR, '>/dev/null');
  }
}



while (<LOG_FILE>) {
  if (!/$log_tag/) { next; }
  my(@entry_split)=3Dsplit / +/;
  my(%entry);

  #year is not in syslog date format... try to guess it from the local
time
  # ***TODO*** what happen when the year change ?
  my($year);
  (undef,undef,undef,undef,undef,$year,undef,undef,undef) =3D
localtime(time);
  $year +=3D 1900;

=20
$entry{'date'}=3D"$year-".$m{shift(@entry_split)}."-".shift(@entry_split)=
.
"=20
".shift(@entry_split);
  $entry{'host'}=3Dshift(@entry_split);

  shift(@entry_split); # kernel:

  shift(@entry_split); # [IPTABLES

  my($chain_name)=3Dshift(@entry_split); # DROP]
  $chain_name=3D~s/\]//;

  shift(@entry_split); # :
  foreach (@entry_split) {
    if (/(.*)=3D(.*)/) {
      (my($field),my($value))=3Dsplit /=3D/;
      $entry{$field}=3D$value;
    }
  }
  my($iaddr) =3D inet_aton($entry{'SRC'});
  my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"SRC_NAME"}=3D$host_name; } else=20
{ $entry{"SRC_NAME"}=3D"unknown"; }

  open(HOST,"host $entry{'SRC'} |");
  my($result)=3D<HOST>;
  if ($result=3D~s/Name: (.*)$/$1/) {
    $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
  } else {
    if ($result=3D~s/.* pointer (.*)\.$/$1/) {
      $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
    } else { $entry{"SRC_NAME"}=3D"unknown"; }
  }
  close(HOST);

  my($iaddr) =3D inet_aton($entry{'DST'});
  my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"DST_NAME"}=3D$host_name; } else=20
{ $entry{"DST_NAME"}=3D"unknown"; }

  open(HOST,"host $entry{'DST'} |");
  my($result)=3D<HOST>;
  if ($result=3D~s/Name: (.*)$/$1/) {
    $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
  } else {
    if ($result=3D~s/.* pointer (.*)\.$/$1/) {
      $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
    } else { $entry{"DST_NAME"}=3D"unknown"; }
  }

  close(HOST);

=20
my($dummy)=3D"'".$entry{"host"}."','".$entry{"date"}."','".$chain_name."'=
,
'".
$entry{'IN'}."','".$entry{'SRC'}."','".$entry{'SRC_NAME'}."','".
$entry{'DST'}."','".$entry{'DST_NAME'}."','".$entry{'PROTO'}."','".
$entry{'SPT'}."','".$entry{'DPT'}."'";

  print "$dummy\n";


  $dbh->do("insert into logs
           (host,date,chain,interface_in, ip_src, name_src, ip_dest,=20
name_dest, proto, port_src, port_dest) values ($dummy)");


}
  $dbh->disconnect();

sub got_int {
    $SIG{INT} =3D \&got_int;          # but not for SIGCHLD!
    close(LOG_FILE);
}


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. =
http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclick
_______________________________________________
Iptablelog-users mailing list
Ipt...@li...
https://lists.sourceforge.net/lists/listinfo/iptablelog-users

[Iptablelog-users] Feed-db.pl & Feed-db-suse.php

[Johan K. <jk...@da...>]

Hi All 

Please help with this one as I have been struggling for a week. 

Everyting has been setup up correct but when I run feed-db.pl  it's just 
sitting there doing nothing!?! 
Can I set it up to log or give me some output?


Here is the script that came with the Installation which I have modified to 
work on my current system. 

 
 #!/usr/bin/perl

use strict;
use DBI;
use POSIX qw(strftime);

# IPTable log analyzer
# Copyright (C) 2002 Gerald GARCIA
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Plac<B2>e - Suite 330, Boston, MA  02111-1307, 
USA.
#
# Contact author : ge...@ge...

# $Id: feed_db.pl,v 1.8 2002/11/12 20:43:18 gege Exp $

use Socket;


######################################################################################################
#################        C O N F I G     S E C T I O N             
###################################
######################################################################################################

my $dsn = 'DBI:mysql:iptables:localhost';
my $db_user_name = 'root';
my $db_password = '';
my $log_file = '/var/log/iptables';
my $pid_file = "/var/run/iptablelog.pid";

######################################################################################################
#################        E N D   O F   C O N F I G     S E C T I O N       
###########################
######################################################################################################


my $go_to_background=($ARGV[0] eq '--background');

$SIG{INT} = \&got_int;

my ($id, $password);
my $dbh = DBI->connect($dsn, $db_user_name, $db_password);


# get the short name of months according to the locale
# thanks to Bill Garrett <memesis at users.sourceforge.net>
my(%m);
my($month_nb);
for $month_nb (0..11) {
    $m{strftime("%b", 0, 0, 0, 1, $month_nb, 96)}=sprintf("%02d",$month_nb+1);
}

my($key);
foreach $key (keys %m) {
  print $key,"-",$m{$key},"\n";
}


my($log_tag)="IPTABLES";

open(LOG_FILE,"tail -f $log_file 2>/dev/null |") or die "Unable to open log 
file $log_file : $!\n";


#fork to background
if ($go_to_background) {
  my($f) = fork();
  if (!defined($f)) { die "Unable to fork : $!\n"; }
  if($f) {
    # parent
    open(PID, ">$pid_file") or die "Unable to create pid file $pid_file: $!";
    print PID "$f\n";
    close PID;
    exit(0);
  } else {
    # child
    close STDIN;
    open(STDIN, '</dev/null');
    close STDOUT;
    open(STDOUT, '>/dev/null');
    close STDERR;
    open(STDERR, '>/dev/null');
  }
}



while (<LOG_FILE>) {
  if (!/$log_tag/) { next; }
  my(@entry_split)=split / +/;
  my(%entry);

  #year is not in syslog date format... try to guess it from the local time
  # ***TODO*** what happen when the year change ?
  my($year);
  (undef,undef,undef,undef,undef,$year,undef,undef,undef) = localtime(time);
  $year += 1900;

  $entry{'date'}="$year-".$m{shift(@entry_split)}."-".shift(@entry_split)." 
".shift(@entry_split);
  $entry{'host'}=shift(@entry_split);

  shift(@entry_split); # kernel:

  shift(@entry_split); # [IPTABLES

  my($chain_name)=shift(@entry_split); # DROP]
  $chain_name=~s/\]//;

  shift(@entry_split); # :
  foreach (@entry_split) {
    if (/(.*)=(.*)/) {
      (my($field),my($value))=split /=/;
      $entry{$field}=$value;
    }
  }
  my($iaddr) = inet_aton($entry{'SRC'});
  my($host_name) = gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"SRC_NAME"}=$host_name; } else 
{ $entry{"SRC_NAME"}="unknown"; }

  open(HOST,"host $entry{'SRC'} |");
  my($result)=<HOST>;
  if ($result=~s/Name: (.*)$/$1/) {
    $result=~s/\n//; $entry{"SRC_NAME"}=$result;
  } else {
    if ($result=~s/.* pointer (.*)\.$/$1/) {
      $result=~s/\n//; $entry{"SRC_NAME"}=$result;
    } else { $entry{"SRC_NAME"}="unknown"; }
  }
  close(HOST);

  my($iaddr) = inet_aton($entry{'DST'});
  my($host_name) = gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"DST_NAME"}=$host_name; } else 
{ $entry{"DST_NAME"}="unknown"; }

  open(HOST,"host $entry{'DST'} |");
  my($result)=<HOST>;
  if ($result=~s/Name: (.*)$/$1/) {
    $result=~s/\n//; $entry{"DST_NAME"}=$result;
  } else {
    if ($result=~s/.* pointer (.*)\.$/$1/) {
      $result=~s/\n//; $entry{"DST_NAME"}=$result;
    } else { $entry{"DST_NAME"}="unknown"; }
  }

  close(HOST);

  my($dummy)="'".$entry{"host"}."','".$entry{"date"}."','".$chain_name."','".
$entry{'IN'}."','".$entry{'SRC'}."','".$entry{'SRC_NAME'}."','".
$entry{'DST'}."','".$entry{'DST_NAME'}."','".$entry{'PROTO'}."','".
$entry{'SPT'}."','".$entry{'DPT'}."'";

  print "$dummy\n";


  $dbh->do("insert into logs
           (host,date,chain,interface_in, ip_src, name_src, ip_dest, 
name_dest, proto, port_src, port_dest) values ($dummy)");


}
  $dbh->disconnect();

sub got_int {
    $SIG{INT} = \&got_int;          # but not for SIGCHLD!
    close(LOG_FILE);
}

[Iptablelog-users] Log analyzer not showing reports in Html format

[Sanjay S. <san...@gm...>]

Hi Group
I recently installed iptables and log analyzer  on my server with the
help of iptablerocks documentation. Every thing is working fine except
log analyzer. I can see output in firewall file but in grapical format
it is showing Records 0 to ) of 0 and no records in database.
Can any one tell me how I can modify my configuration so that i can
able to view output in html format.

Sanjay

[Iptablelog-users] feed_db.pl Running In Background

[Mike B. <mby...@co...>]

Hello.

Last week I came across iptables logs and decided to give it a try. 
Everything has been great except for the feed_db.pl script.

Basically when I run it with --background, nothing happens.   If I run
it without any args, it works just fine.  I did notice though that it
spawned two instances of tail:

root     27826  0.0  0.2   2600  1212 pts/0    S    14:02   0:00 sh -c
tail --follow=name --retry /var/log/iptables 2>/dev/null
root     27827  0.0  0.1   1972   648 pts/0    S    14:02   0:00 tail
--follow=name --retry /var/log/iptables


When I try to run the top one, no output is ever given.  Anyone have any
ideas or suggestions on what I can do to help debug the script or find a
way for it to work?

Also, out of curiousity, why was the decision made to use the tail
binary as opposed to File::Tail?

Thanks,
Mike

Re: [Iptablelog-users] iptables log con fwbuilder

[Daniel T. <ta...@fu...>]

There is new code in the cvs repository that uses ulogd to populate the 
database.  I have used it with fwbuilder logs with no problems.


Daniel



GLORIA MARTIN MARTIN wrote:
> 
>     Have you use iptables log anlyzer with de log generated by fwbuilder?
>  
> My log file has lines like this:
>  
> kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8203 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
> Jun  5 04:15:09 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=202 TOS=0x00 PREC=0x00 TTL=128 ID=8204 PROTO=UDP 
> SPT=138 DPT=138 LEN=182
> Jun  5 04:15:09 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8205 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
> Jun  5 04:15:10 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8206 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
> Jun  5 04:15:10 tadao kernel: RULE 15 -- DENY IN=eth1 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=138.100.42.140 
> DST=138.100.42.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=8207 PROTO=UDP 
> SPT=137 DPT=137 LEN=58
>  
> So i think the format is not the same that the feed.pl script uses.
>  
>  
> Anyone has done the script for this format?
>  
>  

[Iptablelog-users] iptables log con fwbuilder

[GLORIA M. M. <gm...@aq...>]

    Have you use iptables log anlyzer with de log generated by =
fwbuilder?

My log file has lines like this:

kernel: RULE 15 -- DENY IN=3Deth1 OUT=3D =
MAC=3Dff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=3D138.100.42.140 =
DST=3D138.100.42.255 LEN=3D78 TOS=3D0x00 PREC=3D0x00 TTL=3D128 ID=3D8203 =
PROTO=3DUDP SPT=3D137 DPT=3D137 LEN=3D58=20
Jun  5 04:15:09 tadao kernel: RULE 15 -- DENY IN=3Deth1 OUT=3D =
MAC=3Dff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=3D138.100.42.140 =
DST=3D138.100.42.255 LEN=3D202 TOS=3D0x00 PREC=3D0x00 TTL=3D128 =
ID=3D8204 PROTO=3DUDP SPT=3D138 DPT=3D138 LEN=3D182=20
Jun  5 04:15:09 tadao kernel: RULE 15 -- DENY IN=3Deth1 OUT=3D =
MAC=3Dff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=3D138.100.42.140 =
DST=3D138.100.42.255 LEN=3D78 TOS=3D0x00 PREC=3D0x00 TTL=3D128 ID=3D8205 =
PROTO=3DUDP SPT=3D137 DPT=3D137 LEN=3D58=20
Jun  5 04:15:10 tadao kernel: RULE 15 -- DENY IN=3Deth1 OUT=3D =
MAC=3Dff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=3D138.100.42.140 =
DST=3D138.100.42.255 LEN=3D78 TOS=3D0x00 PREC=3D0x00 TTL=3D128 ID=3D8206 =
PROTO=3DUDP SPT=3D137 DPT=3D137 LEN=3D58=20
Jun  5 04:15:10 tadao kernel: RULE 15 -- DENY IN=3Deth1 OUT=3D =
MAC=3Dff:ff:ff:ff:ff:ff:00:0a:5e:4f:44:1a:08:00 SRC=3D138.100.42.140 =
DST=3D138.100.42.255 LEN=3D78 TOS=3D0x00 PREC=3D0x00 TTL=3D128 ID=3D8207 =
PROTO=3DUDP SPT=3D137 DPT=3D137 LEN=3D58

So i think the format is not the same that the feed.pl script uses.


Anyone has done the script for this format?

Re: [Iptablelog-users] iptablelog on FEDORA CORE3

[Gilles Y. <gi...@gm...>]

OK. i have moved a little step forward, all activities on my firewall is=20
being logged into my iptablelog file located in /var/log.
But i cannot make it work with the web page, my SQL database is still empty=
=20
and nothing appears on the HTML page.
Is there a way where i can check for any errors in mysql database.

Thanks
gy

On 5/12/05, Andy McDade <red...@gm...> wrote:
>=20
> I had to change the startup script myself. This is what it looks like
> now - only a minor change:
>=20
> #!/bin/sh
> #
> # System V init script for iptables logfile analyzer
> #
> # (c) Thomas Vallaitis <bon...@gm...>
> #
> # pid isn't saved by iptables logfile analyzer (afaik)
> # we have two processes -> more difficult
> #
>=20
> PATH=3D"/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
> LONGNAME=3D"iptables logfile analyzer"
> NAME=3D"iptablelog"
> DAEMON=3D'/usr/local/bin/feed_db.pl'
>=20
> set -e
>=20
> # Main Loop
> case $1 in
> start)
> echo -n "Starting $LONGNAME: ";
> #$DAEMON --background
> nohup $DAEMON & > /var/log/iptablelog.log 2>&1
> echo $NAME;
> ;;
> stop)
> echo -n "Stopping $LONGNAME: "
> #/var/run/$NAME.pid || true
> kill $(cat /var/run/$NAME.pid )
> rm -f /var/run/$NAME.pid > /dev/null
> echo $NAME
> ;;
> *)
> N=3D/etc/init.d/$NAME
> # echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
> echo "Usage: $N {start|stop}" >&2
> exit 1
> ;;
> esac
>=20
> exit 0
>=20
> # EOF
>=20
> On 5/12/05, Gilles Yue <gi...@gm...> wrote:
> > Hi everyone,
> > I have a linux box with FEDORA CORE 3 and iptables version 1.2.11
> > installed.
> > I have installed iptables Log Analyzer v0.4, however, when i run the ru=
n
> > /etc/init.d/iptablelog start, nothing happens, i can't find any data on=
=20
> the
> > webpage and even worse, i cannot find any iptablelog daemon running. I
> > don't get any error messages and i have followed exactly as written on=
=20
> the
> > installation guide at http://iptablesrocks.org.
> > Has anybody experienced this problem before, thanks.
> >
> > gy
> >
>=20
> -------------------------------------------------------
> This SF.Net <http://SF.Net> email is sponsored by Oracle Space Sweepstake=
s
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_ids93&alloc_id=16281&opclick
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>=20



--=20
Gilles Yue
gi...@gm...

Re: [Iptablelog-users] Problems running feed_db.pl

[<tdo...@ho...>]

There are lines scrolling over ther screen like
'gateway','2005--13=20
09:01:12','DROP','eth1','192.168.0.1','eistaenzer.lokales-netz.de','192.1=
68.0.2','gateway.lokales-netz.de','UDP','32962','137'

For me it seems that the date format is not ok.
The date field in the record looks like 0000-00-00 00:00:00

Tobias.


Brown, Michael D schrieb:

>Take out the --background part of the script and see what scrolls across=
 the screen once you start it
>
>Thanks,
>Michael Brown,=20
>
>
>-----Original Message-----
>From: ipt...@li... [mailto:iptablelog-us=
ers...@li...] On Behalf Of Tobias D=F6rkes
>Sent: Thursday, May 12, 2005 1:29 PM
>To: ipt...@li...
>Subject: Re: [Iptablelog-users] Problems running feed_db.pl
>
>I am sure it is. I did some "ps -ef" and saw the processes ...
>
>Tobias.
>
>Brown, Michael D schrieb:
>
> =20
>
>>When you start it from the script, make sure it is running... which it =
may not be...=20
>>
>>Thanks,
>>Michael Brown,=20
>>
>>-----Original Message-----
>>From: ipt...@li... [mailto:iptablelog-u=
ser...@li...] On Behalf Of Tobias D=F6rkes
>>Sent: Thursday, May 12, 2005 11:19 AM
>>To: ipt...@li...
>>Subject: [Iptablelog-users] Problems running feed_db.pl
>>
>>Hi list,
>>
>>i have a question regarding feed_db.pl. When running feed_db.pl invoked=
=20
>>by start-stop-script iptableslog, it does not collect any data ... But=20
>>when starting the script without the background parameter directly from=
=20
>>command line everything works fine. I am running SuSE 9.1. are there an=
y=20
>>changes i have to implement either to the script or the environment ?
>>
>>If anybody needs some more information, just drop a mail.
>>
>>Any help appreciated,
>>
>>Tobias D=F6rkes
>>
>>
>>
>>
>>
>>-------------------------------------------------------
>>This SF.Net email is sponsored by Oracle Space Sweepstakes
>>Want to be the first software developer in space?
>>Enter now for the Oracle Space Sweepstakes!
>>http://ads.osdn.com/?ad_ids93&alloc_id=16281&op=3Dclick
>>_______________________________________________
>>Iptablelog-users mailing list
>>Ipt...@li...
>>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>>
>>
>>
>>-------------------------------------------------------
>>This SF.Net email is sponsored by Oracle Space Sweepstakes
>>Want to be the first software developer in space?
>>Enter now for the Oracle Space Sweepstakes!
>>http://ads.osdn.com/?ad_ids93&alloc_id=16281&op=3Dclick
>>_______________________________________________
>>Iptablelog-users mailing list
>>Ipt...@li...
>>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>>
>>
>>=20
>>
>>   =20
>>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by Oracle Space Sweepstakes
>Want to be the first software developer in space?
>Enter now for the Oracle Space Sweepstakes!
>http://ads.osdn.com/?ad_ids93&alloc_id=16281&op=3Dclick
>_______________________________________________
>Iptablelog-users mailing list
>Ipt...@li...
>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>
>
>
> =20
>

Re: [Iptablelog-users] iptablelog on FEDORA CORE3

[Gilles Y. <gi...@gm...>]

Hi, Could you explain more about this command

/var/log/iptablelog.log 2>&1

My log file is found at /var/log/iptableslog and i am confused abot the=20
2>1???

Thanks
gy


On 5/12/05, Andy McDade <red...@gm...> wrote:
>=20
> I had to change the startup script myself. This is what it looks like
> now - only a minor change:
>=20
> #!/bin/sh
> #
> # System V init script for iptables logfile analyzer
> #
> # (c) Thomas Vallaitis <bon...@gm...>
> #
> # pid isn't saved by iptables logfile analyzer (afaik)
> # we have two processes -> more difficult
> #
>=20
> PATH=3D"/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
> LONGNAME=3D"iptables logfile analyzer"
> NAME=3D"iptablelog"
> DAEMON=3D'/usr/local/bin/feed_db.pl'
>=20
> set -e
>=20
> # Main Loop
> case $1 in
> start)
> echo -n "Starting $LONGNAME: ";
> #$DAEMON --background
> nohup $DAEMON & > /var/log/iptablelog.log 2>&1
> echo $NAME;
> ;;
> stop)
> echo -n "Stopping $LONGNAME: "
> #/var/run/$NAME.pid || true
> kill $(cat /var/run/$NAME.pid )
> rm -f /var/run/$NAME.pid > /dev/null
> echo $NAME
> ;;
> *)
> N=3D/etc/init.d/$NAME
> # echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
> echo "Usage: $N {start|stop}" >&2
> exit 1
> ;;
> esac
>=20
> exit 0
>=20
> # EOF
>=20
> On 5/12/05, Gilles Yue <gi...@gm...> wrote:
> > Hi everyone,
> > I have a linux box with FEDORA CORE 3 and iptables version 1.2.11
> > installed.
> > I have installed iptables Log Analyzer v0.4, however, when i run the ru=
n
> > /etc/init.d/iptablelog start, nothing happens, i can't find any data on=
=20
> the
> > webpage and even worse, i cannot find any iptablelog daemon running. I
> > don't get any error messages and i have followed exactly as written on=
=20
> the
> > installation guide at http://iptablesrocks.org.
> > Has anybody experienced this problem before, thanks.
> >
> > gy
> >
>=20
> -------------------------------------------------------
> This SF.Net <http://SF.Net> email is sponsored by Oracle Space Sweepstake=
s
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_ids93&alloc_id=16281&opclick
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>=20



--=20
Gilles Yue
gi...@gm...

Re: [Iptablelog-users] iptablelog on FEDORA CORE3

[Gilles Y. <gi...@gm...>]

SGksCgpJIGhhdmUgYWRkZWQgd2hhdCB1IHNhaWQsIGJ1dCBzdGlsbCBubyBkYXRhLgpXaGF0IGkg
Y2FuIHNlZSBpbiBteSBsb2cgZmlsZXMgYXJlIAoKTWF5IDEzIDA4OjQ2OjExIGZjMyBsYXN0IG1l
c3NhZ2UgcmVwZWF0ZWQgMTM2NiB0aW1lcwpNYXkgMTMgMDg6NDc6MTIgZmMzIGxhc3QgbWVzc2Fn
ZSByZXBlYXRlZCAxMzI0IHRpbWVzCk1heSAxMyAwODo0ODoxMyBmYzMgbGFzdCBtZXNzYWdlIHJl
cGVhdGVkIDEzMTYgdGltZXMKTWF5IDEzIDA4OjQ5OjE0IGZjMyBsYXN0IG1lc3NhZ2UgcmVwZWF0
ZWQgMTQ2NyB0aW1lcwpNYXkgMTMgMDg6NTA6MTUgZmMzIGxhc3QgbWVzc2FnZSByZXBlYXRlZCAx
NDkyIHRpbWVzCk1heSAxMyAwODo1MToxNiBmYzMgbGFzdCBtZXNzYWdlIHJlcGVhdGVkIDE1Mjgg
dGltZXMKCkknbSBub3Qgc3VyZSB3aGV0aGVyIGl0JyBzIG15IHN5bnRheCBvbiBteSBpcHRhYmxl
cyBzY3JpcHQgd2hpY2ggbWF5IGJlIAp3cm9uZy4KCiRJUFRBQkxFUyAtTiBMT0dfRFJPUCAKCiRJ
UFRBQkxFUyAtTiBMT0dfQUNDRVBUCgokSVBUQUJMRVMgLUEgTE9HX0RST1AgLWogTE9HIC0tbG9n
LXByZWZpeCAiW0lQVEFCTEVTIERST1BdIDogIiAKLS1sb2ctdGNwLW9wdGlvbnMgLS1sb2ctaXAt
b3B0aW9ucwoKJElQVEFCTEVTIC1BIExPR19EUk9QIC1qIERST1AKCiRJUFRBQkxFUyAtQSBMT0df
QUNDRVBUIC1qIExPRyAtLWxvZy1wcmVmaXggIltJUFRBQkxFUyBBQ0NFUFRdIDogIiAKLS1sb2ct
dGNwLW9wdGlvbnMgLS1sb2ctaXAtb3B0aW9ucwoKJElQVEFCTEVTIC1BIExPR19BQ0NFUFQgLWog
QUNDRVBUCgpBbnkgSWRlYT8/V2hhdCBtYXkgY2F1c2UgdGhlIHByb2JsZW0/Cgp0aGFua3MgCmd5
CgoKT24gNS8xMi8wNSwgQnJvd24sIE1pY2hhZWwgRCA8TWljaGFlbC5ELkJyb3duQGZuZi5jb20+
IHdyb3RlOgo+IAo+ICBZb3Ugd2lsbCBuZWVkIHRvIGVkaXQgdGhhdCBmaWxlIGFuZCBwdXQgdGhl
IGZvbGxvd2luZyBpbiBpdCBvciBqdXN0IHN0YXJ0IAo+IGl0IG1hbnVhbGx5IC91c3IvbG9jYWxi
aW4vZmVlZF9kYi5wbCAoIHVzZSCWYmFja2dyb3VuZCB0byBtYWtlIGl0IGZvcmspCj4gCj4gIFBB
VEg9Ii91c3IvbG9jYWwvc2JpbjovdXNyL2xvY2FsL2Jpbjovc2JpbjovYmluOi91c3Ivc2Jpbjov
dXNyL2JpbiIKPiAKPiBMT05HTkFNRT0iaXB0YWJsZXMgbG9nZmlsZSBhbmFseXplciIKPiAKPiBO
QU1FPSJpcHRhYmxlbG9nIgo+IAo+IERBRU1PTj0nL3Vzci9sb2NhbC9iaW4vZmVlZF9kYi5wbCcK
PiAKPiAgc2V0IC1lCj4gCj4gICMgTWFpbiBMb29wCj4gCj4gY2FzZSAkMSBpbgo+IAo+IHN0YXJ0
KQo+IAo+IGVjaG8gLW4gIlN0YXJ0aW5nICRMT05HTkFNRTogIjsKPiAKPiAkREFFTU9OIC0tYmFj
a2dyb3VuZAo+IAo+IGVjaG8gJE5BTUU7Cj4gCj4gOzsKPiAKPiBzdG9wKQo+IAo+IGVjaG8gLW4g
IlN0b3BwaW5nICRMT05HTkFNRTogIgo+IAo+IGtpbGxhbGwgLTkgZmVlZF9kYi5wbAo+IAo+IHJt
IC1mIC92YXIvcnVuLyROQU1FLnBpZAo+IAo+IGVjaG8gJE5BTUUKPiAKPiA7Owo+IAo+ICopCj4g
Cj4gTj0vZXRjL2luaXQuZC8kTkFNRQo+IAo+ICMgZWNobyAiVXNhZ2U6ICROIHtzdGFydHxzdG9w
fHJlc3RhcnR8cmVsb2FkfGZvcmNlLXJlbG9hZH0iID4mMgo+IAo+IGVjaG8gIlVzYWdlOiAkTiB7
c3RhcnR8c3RvcH0iID4mMgo+IAo+IGV4aXQgMQo+IAo+IDs7Cj4gCj4gZXNhYwo+IAo+ICBleGl0
IDAKPiAKPiAgIyBFT0YKPiAKPiAgVGhhbmtzLAo+IAo+IE1pY2hhZWwgQnJvd24sCj4gICAtLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KPiAgCj4gKkZyb206KiBpcHRhYmxlbG9nLXVzZXJz
LWFkbWluQGxpc3RzLnNvdXJjZWZvcmdlLm5ldCBbbWFpbHRvOgo+IGlwdGFibGVsb2ctdXNlcnMt
YWRtaW5AbGlzdHMuc291cmNlZm9yZ2UubmV0XSAqT24gQmVoYWxmIE9mICpHaWxsZXMgWXVlCj4g
KlNlbnQ6KiBUaHVyc2RheSwgTWF5IDEyLCAyMDA1IDE6MDAgQU0KPiAqVG86KiBpcHRhYmxlbG9n
LXVzZXJzQGxpc3RzLnNvdXJjZWZvcmdlLm5ldAo+ICpTdWJqZWN0OiogW0lwdGFibGVsb2ctdXNl
cnNdIGlwdGFibGVsb2cgb24gRkVET1JBIENPUkUzCj4gIAo+ICBIaSBldmVyeW9uZSwgCj4gSSBo
YXZlIGEgbGludXggYm94IHdpdGggRkVET1JBIENPUkUgMyBhbmQgaXB0YWJsZXMgdmVyc2lvbiAx
LjIuMTFpbnN0YWxsZWQuCj4gSSBoYXZlIGluc3RhbGxlZCBpcHRhYmxlcyBMb2cgQW5hbHl6ZXIg
djAuNCwgaG93ZXZlciwgd2hlbiBpIHJ1biB0aGUgcnVuIAo+IC9ldGMvaW5pdC5kL2lwdGFibGVs
b2cgc3RhcnQsIG5vdGhpbmcgaGFwcGVucywgaSBjYW4ndCBmaW5kIGFueSBkYXRhIG9uIHRoZSAK
PiB3ZWJwYWdlIGFuZCBldmVuIHdvcnNlLCBpIGNhbm5vdCBmaW5kIGFueSBpcHRhYmxlbG9nIGRh
ZW1vbiBydW5uaW5nLiBJIGRvbid0IAo+IGdldCBhbnkgZXJyb3IgbWVzc2FnZXMgYW5kIGkgaGF2
ZSBmb2xsb3dlZCBleGFjdGx5IGFzIHdyaXR0ZW4gb24gdGhlIAo+IGluc3RhbGxhdGlvbiBndWlk
ZSBhdCBodHRwOi8vaXB0YWJsZXNyb2Nrcy5vcmcuCj4gSGFzIGFueWJvZHkgZXhwZXJpZW5jZWQg
dGhpcyBwcm9ibGVtIGJlZm9yZSwgdGhhbmtzLgo+IAo+IGd5Cj4gIAoKCgotLSAKR2lsbGVzIFl1
ZQpnaWxsZXN5QGdtYWlsLmNvbQo=

Re: [Iptablelog-users] Problems running feed_db.pl

[<tdo...@ho...>]

I am sure it is. I did some "ps -ef" and saw the processes ...

Tobias.

Brown, Michael D schrieb:

>When you start it from the script, make sure it is running... which it m=
ay not be...=20
>
>Thanks,
>Michael Brown,=20
>
>-----Original Message-----
>From: ipt...@li... [mailto:iptablelog-us=
ers...@li...] On Behalf Of Tobias D=F6rkes
>Sent: Thursday, May 12, 2005 11:19 AM
>To: ipt...@li...
>Subject: [Iptablelog-users] Problems running feed_db.pl
>
>Hi list,
>
>i have a question regarding feed_db.pl. When running feed_db.pl invoked=20
>by start-stop-script iptableslog, it does not collect any data ... But=20
>when starting the script without the background parameter directly from=20
>command line everything works fine. I am running SuSE 9.1. are there any=
=20
>changes i have to implement either to the script or the environment ?
>
>If anybody needs some more information, just drop a mail.
>
>Any help appreciated,
>
>Tobias D=F6rkes
>
>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by Oracle Space Sweepstakes
>Want to be the first software developer in space?
>Enter now for the Oracle Space Sweepstakes!
>http://ads.osdn.com/?ad_ids93&alloc_id=16281&op=3Dclick
>_______________________________________________
>Iptablelog-users mailing list
>Ipt...@li...
>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by Oracle Space Sweepstakes
>Want to be the first software developer in space?
>Enter now for the Oracle Space Sweepstakes!
>http://ads.osdn.com/?ad_ids93&alloc_id=16281&op=3Dclick
>_______________________________________________
>Iptablelog-users mailing list
>Ipt...@li...
>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>
>
> =20
>

Re: [Iptablelog-users] iptablelog on FEDORA CORE3

[Andy M. <red...@gm...>]

I had to change the startup script myself.  This is what it looks like
now - only a minor change:

#!/bin/sh
#
# System V init script for iptables logfile analyzer
#
# (c) Thomas Vallaitis <bon...@gm...>
#
# pid isn't saved by iptables logfile analyzer (afaik)
# we have two processes -> more difficult
#

PATH=3D"/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
LONGNAME=3D"iptables logfile analyzer"
NAME=3D"iptablelog"
DAEMON=3D'/usr/local/bin/feed_db.pl'

set -e

# Main Loop
case $1 in
start)
      echo -n "Starting $LONGNAME: ";
      #$DAEMON --background
      nohup $DAEMON & > /var/log/iptablelog.log 2>&1
      echo $NAME;
        ;;
stop)
      echo -n "Stopping $LONGNAME: "
      #/var/run/$NAME.pid || true
      kill $(cat /var/run/$NAME.pid )
      rm -f /var/run/$NAME.pid > /dev/null
      echo $NAME
        ;;
*)
        N=3D/etc/init.d/$NAME
        # echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
        echo "Usage: $N {start|stop}" >&2
        exit 1
        ;;
esac
=20
exit 0
=20
# EOF


On 5/12/05, Gilles Yue <gi...@gm...> wrote:
> Hi everyone,=20
>  I have a linux box with FEDORA CORE 3 and iptables version 1.2.11
> installed.
>  I have installed iptables Log Analyzer v0.4, however, when i run the run
> /etc/init.d/iptablelog start, nothing happens, i can't find any data on t=
he
> webpage and even worse, i cannot find any iptablelog daemon running.  I
> don't get any error messages and i have followed exactly as written on th=
e
> installation guide at http://iptablesrocks.org.
>  Has anybody experienced this problem before, thanks.
> =20
> gy
>

RE: [Iptablelog-users] Problems running feed_db.pl

[Brown, M. D <Mic...@fn...>]

When you start it from the script, make sure it is running... which it =
may not be...=20

Thanks,
Michael Brown,=20

-----Original Message-----
From: ipt...@li... =
[mailto:ipt...@li...] On Behalf Of =
Tobias D=F6rkes
Sent: Thursday, May 12, 2005 11:19 AM
To: ipt...@li...
Subject: [Iptablelog-users] Problems running feed_db.pl

Hi list,

i have a question regarding feed_db.pl. When running feed_db.pl invoked=20
by start-stop-script iptableslog, it does not collect any data ... But=20
when starting the script without the background parameter directly from=20
command line everything works fine. I am running SuSE 9.1. are there any =

changes i have to implement either to the script or the environment ?

If anybody needs some more information, just drop a mail.

Any help appreciated,

Tobias D=F6rkes





-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_ids93&alloc_id=16281&op=3Dclick
_______________________________________________
Iptablelog-users mailing list
Ipt...@li...
https://lists.sourceforge.net/lists/listinfo/iptablelog-users

RE: [Iptablelog-users] iptablelog on FEDORA CORE3

[Brown, M. D <Mic...@fn...>]

You will need to edit that file and put the following in it or just
start it manually /usr/localbin/feed_db.pl   ( use -background to make
it fork)

=20

PATH=3D"/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"

LONGNAME=3D"iptables logfile analyzer"

NAME=3D"iptablelog"

DAEMON=3D'/usr/local/bin/feed_db.pl'

=20

set -e

=20

# Main Loop

case $1 in

start)

      echo -n "Starting $LONGNAME: ";

       $DAEMON  --background

      echo $NAME;

        ;;

stop)

      echo -n "Stopping $LONGNAME: "

      killall -9 feed_db.pl

      rm -f /var/run/$NAME.pid

      echo $NAME

        ;;

*)

        N=3D/etc/init.d/$NAME

        # echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2

        echo "Usage: $N {start|stop}" >&2

        exit 1

        ;;

esac

=20

exit 0

=20

# EOF

=20

Thanks,

Michael Brown,

  _____ =20

From: ipt...@li...
[mailto:ipt...@li...] On Behalf Of
Gilles Yue
Sent: Thursday, May 12, 2005 1:00 AM
To: ipt...@li...
Subject: [Iptablelog-users] iptablelog on FEDORA CORE3

=20

Hi everyone,=20
I have a linux box with FEDORA CORE 3 and iptables version 1.2.11
installed.
I have installed iptables Log Analyzer v0.4, however, when i run the run
/etc/init.d/iptablelog start, nothing happens, i can't find any data on
the webpage and even worse, i cannot find any iptablelog daemon running.
I don't get any error messages and i have followed exactly as written on
the installation guide at http://iptablesrocks.org.
Has anybody experienced this problem before, thanks.

gy

Re: [Iptablelog-users] Problems running feed_db.pl

[Andy M. <red...@gm...>]

try changing the startup script.  I had to change this line:

$DAEMON --background

to this :

nohup $DAEMON & > /var/log/iptablelog.log 2>&1


On 5/12/05, Tobias D=F6rkes <tdo...@ho...> wrote:
> Hi list,
>=20
> i have a question regarding feed_db.pl. When running feed_db.pl invoked
> by start-stop-script iptableslog, it does not collect any data ... But
> when starting the script without the background parameter directly from
> command line everything works fine. I am running SuSE 9.1. are there any
> changes i have to implement either to the script or the environment ?
>=20
> If anybody needs some more information, just drop a mail.
>=20
> Any help appreciated,
>=20
> Tobias D=F6rkes
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_ids93&alloc_id=16281&opclick
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>

[Iptablelog-users] Problems running feed_db.pl

[<tdo...@ho...>]

Hi list,

i have a question regarding feed_db.pl. When running feed_db.pl invoked=20
by start-stop-script iptableslog, it does not collect any data ... But=20
when starting the script without the background parameter directly from=20
command line everything works fine. I am running SuSE 9.1. are there any=20
changes i have to implement either to the script or the environment ?

If anybody needs some more information, just drop a mail.

Any help appreciated,

Tobias D=F6rkes

[Iptablelog-users] Problems running feed_db.pl

[<tdo...@ho...>]

Hi list,

i have a question regarding feed_db.pl. When running feed_db.pl invoked=20
by start-stop-script iptableslog, it does not collect any data ... But=20
when starting the script without the background parameter directly from=20
command line everything works fine. I am running SuSE 9.1. are there any=20
changes i have to implement either to the script or the environment ?

If anybody needs some more information, just drop a mail.

Any help appreciated,

Tobias D=F6rkes

[Iptablelog-users] iptablelog on FEDORA CORE3

[Gilles Y. <gi...@gm...>]

Hi everyone,=20
I have a linux box with FEDORA CORE 3 and iptables version 1.2.11 installed=
.
I have installed iptables Log Analyzer v0.4, however, when i run the run=20
/etc/init.d/iptablelog start, nothing happens, i can't find any data on the=
=20
webpage and even worse, i cannot find any iptablelog daemon running. I don'=
t=20
get any error messages and i have followed exactly as written on the=20
installation guide at http://iptablesrocks.org.
Has anybody experienced this problem before, thanks.

gy

[Iptablelog-users] iptableslog error

[Rana R. A. <rr...@co...>]

when I try to run iptableslog script I got this error plzzz help me waht
to do I am working on this from last 4 days but still unsecessfull.


[root@proxy web]# /etc/rc.d/init.d/iptablelog start
Starting iptables logfile analyzer: /etc/rc.d/init.d/iptablelog: line 22:
start-stop-daemon: command not found


Rizwan.

RE: [Iptablelog-users] Problem with mysql query.

[Brown, M. <Mic...@In...>]

Check your syntax, it looks like you have a space in there "id entified"


And I just ran the following command on one of my mysql servers with no
problems:

grant create temporary tables on phoenix.* to customer2@localhost
identified by '1';

Thanks,
Michael Brown

-----Original Message-----
From: Luca Vatore [mailto:luc...@al...]=20
Sent: Wednesday, March 16, 2005 12:03 PM
Cc: ipt...@li...
Subject: Re: [Iptablelog-users] Problem with mysql query.

Brown, Michael wrote:

>You just forgot your TO before the user
>
>grant create temporary tables on iptables.* TO iptables_user@localhost
>id entified by 'xx';
>
>Thanks,
>Michael Brown
> =20
>
I've tried both "with TO" and "without TO" (as written in the F.A.Q.)=20
but the problem was not that one.

Thanks

Luca Vatore



--=20
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/03/2005



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
_______________________________________________
Iptablelog-users mailing list
Ipt...@li...
https://lists.sourceforge.net/lists/listinfo/iptablelog-users

Re: [Iptablelog-users] Problem with mysql query.

[Luca V. <luc...@al...>]

Brown, Michael wrote:

>You just forgot your TO before the user
>
>grant create temporary tables on iptables.* TO iptables_user@localhost
>id entified by 'xx';
>
>Thanks,
>Michael Brown
>  
>
I've tried both "with TO" and "without TO" (as written in the F.A.Q.) 
but the problem was not that one.

Thanks

Luca Vatore



-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/03/2005

RE: [Iptablelog-users] Problem with mysql query.

[Brown, M. <Mic...@In...>]

You just forgot your TO before the user

grant create temporary tables on iptables.* TO iptables_user@localhost
id entified by 'xx';

Thanks,
Michael Brown

-----Original Message-----
From: Luca Vatore [mailto:luc...@al...]=20
Sent: Wednesday, March 16, 2005 11:40 AM
To: ipt...@li...
Subject: [Iptablelog-users] Problem with mysql query.

Hi to all,
when i try type the query  "grant create temporary tables on iptables.*

iptables_user@localhost id entified by 'xx';" i receive a "1064" error=20
by mysql.
I've cheked many the syntax, so i don't think there is a syntax problem.

Can anyone tel me if there is a solution about this problem.

Thank in advance, sorry for my bad english.

Luca Vatore.


--=20
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/03/2005



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
_______________________________________________
Iptablelog-users mailing list
Ipt...@li...
https://lists.sourceforge.net/lists/listinfo/iptablelog-users

[Iptablelog-users] Problem with mysql query.

[Luca V. <luc...@al...>]

Hi to all,
when i try type the query  "grant create temporary tables on iptables.*  
iptables_user@localhost id entified by 'xx';" i receive a "1064" error 
by mysql.
I've cheked many the syntax, so i don't think there is a syntax problem.

Can anyone tel me if there is a solution about this problem.

Thank in advance, sorry for my bad english.

Luca Vatore.


-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/03/2005

RE: [Iptablelog-users] Handling variable log names?

[Michael L. <mi...@s2...>]

syslog-ng differs from syslog, it can be set to automatically open a new log
file every day/week/month/...  So, I've got a new log file coming into existence
every day, and I was wondering if there was any way to have feed_db notice that.
If it doesn't, could hack in a check to see if the date has changed, and open
another file.  Should be easy.  Right?  :)

  _____  

From: ipt...@li...
[mailto:ipt...@li...] On Behalf Of Brown,
Michael
Sent: February 21, 2005 01:36
To: ipt...@li...
Subject: RE: [Iptablelog-users] Handling variable log names? [u]


the feed_db.pl script just tails your firewall log file and inserts the entries
into the DB. there's nothing else outside of that... if syslog was restarted you
might have to restart the feed_db script to re(open) the file. I myself set up a
script to kill the process, rename the log file and restart everything back... 
 
Michael

-----Original Message----- 
From: Michael Laccetti [mailto:mi...@s2...] 
Sent: Sun 2/20/2005 11:36 PM 
To: ipt...@li... 
Cc: 
Subject: [Iptablelog-users] Handling variable log names?



I've been using syslog-ng to manage my logs, and have it generating a new 
firewall log on a daily basis.  Does IPTables log handle this situation, or 
would some poking and prodding be required to get it to work? 

Mike 


-- 





------------------------------------------------------- 
SF email is sponsored by - The IT Product Guide 
Read honest & candid reviews on hundreds of IT Products from real users. 
Discover which products truly live up to the hype. Start reading now. 
http://ads.osdn.com/?ad_id=6595
<http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click>
&alloc_id=14396&op=click 
_______________________________________________ 
Iptablelog-users mailing list 
Ipt...@li... 
https://lists.sourceforge.net/lists/listinfo/iptablelog-users 



-- 
---------------------[ Ciphire Signature ]----------------------
From: mi...@s2... signed email body (1684 characters)
Date: on 21 February 2005 at 15:24:14 UTC
To:   ipt...@li...
----------------------------------------------------------------
: Ciphire has secured this email against identity theft.
: Free download at www.ciphire.com. The garbled lines
: below are the sender's verifiable digital signature.
----------------------------------------------------------------
00fAAAAAEAAAAe/RlClAYAAI0CAAIAAgACACCF2JwL8FSZ12JHjaqi4keWch0Su1
tLYkwGHFe6dbl/JgEAMU5HZi3bbCGzHuBROgacg8f7vXlTdFsqED3Fgplg8g9559
ODq4ru63L4giR8mIcntJsvyKVf5wrY5SILGEaBig==
------------------[ End Ciphire Signed Message ]----------------