iptablelog-users — Support, Discussions, User oriented

Re: [Iptablelog-users] reporting

[Daniel T. <ta...@fu...>]

I am working on a re-write of the software.

I have dropped the perl script (log parser) in favour of ulogd and added
some Reporting and Admin functionality.  I am cleaning things up and will
probably release a fork of this project (after contacting the author) in the
near future.



Daniel Tarbuck


Salvatore Basso wrote:

>Hi, also I would want to know if the project is still alive, I have approximately 10 installation of iptables and if the 
>project is finish I must unfortunately change to software :(
>thanks.
>
>----------
>        
>        Salvatore.
>
>
>----- Original Message ----- 
>From: "Michael Brown" <Mic...@In...>
>To: <ipt...@li...>
>Sent: Monday, August 02, 2004 4:48 PM
>Subject: [Iptablelog-users] reporting
>
>
>Has anyone modified their instance to include reporting, show more
>details and a query field? I've already changed mine to include
>"TopDestination" stats on the right toolbar underneath "TopHosts" and I
>am about to get more stats and queries underway... There haven't been
>much development on this project and I am willing to help "revive" it or
>contribute to it..
>
> 
>
>Thanks,
>
>Michael 
>
> 
>
>
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by OSTG. Have you noticed the changes on
>Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
>one more big change to announce. We are now OSTG- Open Source Technology
>Group. Come see the changes on the new OSTG site. www.ostg.com
>_______________________________________________
>Iptablelog-users mailing list
>Ipt...@li...
>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>  
>

Re: [Iptablelog-users] reporting

[Salvatore B. <sa...@pi...>]

Hi, also I would want to know if the project is still alive, I have =
approximately 10 installation of iptables and if the=20
project is finish I must unfortunately change to software :(
thanks.

----------
       =20
        Salvatore.


----- Original Message -----=20
From: "Michael Brown" <Mic...@In...>
To: <ipt...@li...>
Sent: Monday, August 02, 2004 4:48 PM
Subject: [Iptablelog-users] reporting


Has anyone modified their instance to include reporting, show more
details and a query field? I've already changed mine to include
"TopDestination" stats on the right toolbar underneath "TopHosts" and I
am about to get more stats and queries underway... There haven't been
much development on this project and I am willing to help "revive" it or
contribute to it..

=20

Thanks,

Michael=20

=20


---
[This E-mail scanned for viruses by Declude Virus]

[Iptablelog-users] reporting

[Michael B. <Mic...@In...>]

Has anyone modified their instance to include reporting, show more
details and a query field? I've already changed mine to include
"TopDestination" stats on the right toolbar underneath "TopHosts" and I
am about to get more stats and queries underway... There haven't been
much development on this project and I am willing to help "revive" it or
contribute to it..

=20

Thanks,

Michael=20

=20

[Iptablelog-users] (no subject)

[<ang...@in...>]

[Iptablelog-users] Problem with "Permission denied"

[Salvatore B. <sa...@pi...>]

Hi, I have the following problem:

[root@firewall bin]# /etc/init.d/iptablelog start

Starting iptables logfile analyzer: /etc/init.d/iptablelog: line 26: =
/usr/bin/feed_db.pl: Permission denied



but it's very strange because the line 26 is:



# $Id: feed_db.pl,v 1.8 2002/11/12 20:43:18 gege Exp $


... this line is comment !!!
Thanks.

----------
       =20
        Salvatore.

---
[This E-mail scanned for viruses by Declude Virus]

[Iptablelog-users] Re : Help me please.

[alfrog <alf...@ya...>]

I had the same problem.
I think it appens when system date isn't in english.
I do this to make it work : (It can be done in better way but I didn't to=
ok=20
the time to look for)

Edit feed_db.pl near line 58, and replace the for generating $m tab


my($month_nb);
for $month_nb (0..11) {
     $m{strftime("%b", 0, 0, 0, 1, $month_nb, 96)}=3Dsprintf("%02d",$mont=
h_nb+1);
}


by this :


$m{"Jan"}=3D1;
$m{"Fev"}=3D2;
$m{"Mar"}=3D3;
$m{"Apr"}=3D4;
$m{"May"}=3D5;
$m{"Jun"}=3D6;
$m{"Jul"}=3D7;
$m{"Aug"}=3D8;
$m{"Sep"}=3D9;
$m{"Oct"}=3D10;
$m{"Nov"}=3D11;
$m{"Dec"}=3D12;

[Iptablelog-users] Help me please.

[Jens S. <je...@js...>]

Excuse my poor english!

Hello!

I have a problem, when the perl script "feed_db.pl", and skall get den month
to conv, from letter to number.

e.g

Jun 18 00:23:12 .........


Jun = 06.

I get wide mysql values "date" 2004--18.

Every is den month?

Download the "IPTable log analyzer" for a week since.

/Jens

[Iptablelog-users] rough ulogd support

[Daniel T. <ta...@fu...>]

Hello

I have attached a diff which adds ulog support to iptables_logger.

It expects to find a standard ulog table (see mysql.table that comes 
with ulogd) in the
database specified in the config file.  To activate it, un comment the 
"table_schema"
variable in the config file.  It doesn't handle the ignore_ports options 
at all.

Since ulog doesn't resolve hosts and uses protocol numbers, instead of 
names, I added
host_cache and protos tables.  The host_cache table is just a DNS cache 
and the protos
table is similar to the ports table.  ulog also does not provide a 
hostname for the firewall,
so I added a default_host_value option in the config file.

ulog doesn't log which chain the entry came from.  Instead, it allows 
you to specify a
prefix for the rule.  I think this is far more useful anyway, so I 
mapped it to the chain
column.

I broke out the admin page and added an option to resolve ip addresses.  
It should be
fairly easy to use.  If you run the app on a linux machine, the "host" 
command should
be available.  It is much faster than the php "gethostbyaddr" command.  
To use this
command instead of gethostbyaddr, uncomment the "host_resolution" 
variable in the
config file.  Note that if you run php in safe mode, you will get a 
warning about using
an external program.  If the program isn't located at '/usr/bin/host', 
you'll need to change
utils/resolver_host.php.

I hope this is useful...
Dan

[Iptablelog-users] Help ME!!! Wrong Values!!

[Adriano T. X. <dri...@te...>]

Sorry my poor english!!!
The values of the table of the bank mysql are made a mistake, my table of=
 logs of mysql is with the following values:  Chain: :eth3 and interface_=
in:  "blank".  what I do?

[Iptablelog-users] (no subject)

[Nguyen D. H. <hi...@el...>]

[Iptablelog-users] Unable to connect to mysql

[Salvatore B. <sa...@pi...>]

Hi, when I try to visualize log I have the following message in the browser:

Warning: mysql_connect(): Access denied for user: 'iptables_user@localhost'
(Using Password:YES) in /var/www/iptables/elems.php on line 43
Unable to connect to mysql

I have verified the files: "root/iptables/scripts/feed_db.pl" and I write:

my $db_password = 'xx'

and file: root/iptables/web/config.php and I write:

$db_password="xx";

.... where mistake?
Thanks.

----------

        Salvatore.

---
[This E-mail scanned for viruses by Declude Virus]

[Iptablelog-users] list of packages

[Salvatore B. <sa...@pi...>]

Hi, where I can find one list of the packages (for MySql, Apache etc etc)
necessary to the installation/operation of iptables log?
Thanks.

----------

        Salvatore.

---
[This E-mail scanned for viruses by Declude Virus]

[Iptablelog-users] iptablelog and rh8 - start service

[Salvatore B. <sa...@pi...>]

Hello, I have a problem with iptablelog on red hat8.
I have installed iptablelog on red hat 8 and I have not had problems, but in
the moment in which I try to make to start the service I do not succeed to
us, happens that:

start the script as root (or any user that can read the iptables logs) by :
/etc/init.d/iptablelog start

but result:

bash:iptablelog: command not found

if run:

#service iptablelog on
Usage: /etc/init.d/iptablelog (start/stop)

if run with:

#service iptablelog start
Starting iptables logfile analyzer: /etc/init.d/iptablelog: line 23:
start-stop
daemon: command not found

how I can resolve? thanks !!

                 - Salvatore

---
[This E-mail scanned for viruses by Declude Virus]

[Iptablelog-users] Re: no entry in web page

[ianux <ia...@fr...>]

okz, I finally made it, using this post :
http://sourceforge.net/tracker/index.php?func=detail&aid=861265&group_id=63361&atid=503691
and this one :
http://sourceforge.net/tracker/index.php?func=detail&aid=822979&group_id=63361&atid=503691
it works !!!

[Iptablelog-users] no entry in web page

[ianux <ia...@fr...>]

I just install and run iptablelog:
- LOG_DROP and LOG_ACCEPT chains have been created (my /var/log/syslog is growing 10mb/mn!!!):
- database is created (using grant create for iptables_user)
- daemon is running and seems to feeding database
- web page is displayed
but there is no data !
like this: 
Last packets filtred by chain ALL younger than 1 day : 
Records 0 to 0 of 0

0	packets in database
0	packets younger than 1 day
0	packets today
First was at
Last was at

using iptables_admin in config.php doesn't change anything...

[Iptablelog-users] Error

[Daniel A. <dan...@it...>]

I am having the following problem after install it, and I try do access the
index.php homepage :

Unable to execute create temporary table filtered_logs select * from logs
where chain='' and TO_DAYS(NOW()) - TO_DAYS(date) < Mysql error : 1064 - You
have an error in your SQL syntax near '' at line 1

Ps. I checked the database and the records are there :)

Can you help me ? Whats goin on ?

Thanks,
Daniel.

[Iptablelog-users] no logging

[Robert <ro...@lu...>]

hallo,

i have a problem because the iptablelog script did not write into my
mysql db.


this are my rules:

iptables -A INPUT -j LOG  --log-prefix '[IPTABLES INPUT]:'
iptables -A OUTPUT -j LOG --log-prefix '[IPTABLES OUTPUT]:'

and here an output from logfile

Jan 22 16:25:32 prodigy kernel: [IPTABLES OUTPUT]:IN= OUT=eth0 SRC=192.168.17.42 DST=212.127.33.29 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=23130 DF PROTO=TCP SPT=22 DPT=4161 WINDOW=5840 RES=0x00 ACK PSH URGP=0





-- 
bestregards
Robert
mailto:ro...@lu...

[Iptablelog-users] mysql updates

[Fred M. <nf...@ho...>]

Hello.

   This is my first time using this product. I was woundering if the
database is updated every time there is a new message from the firewall? Or
do I have to run the feed_db-shorewall.pl every time I want to update my db

 

 

System Info                Running

Mandrake MNF 8.2     (shorewall)

Windows XP Pro         (IIS 5.2 w/PHP & MySql))

 

[Iptablelog-users] Fatal Error connecting to web interface

[Bill J. <bub...@co...>]

Sorry if this has been addressed before

I get the following error when opening the web interface

Fatal error: Call to undefined function: mysql_connect() in
/var/www/html/iptables/elems.php on line 43

I have verified username/passwords and the MySql database is being populated
with data as expected.

Any thoughts/ideas would be greatly appreciated

System is RH9, MySQL 4.0.16 Apache 2.0.40 and PHP 4.2.2

I will gladly post any of the files that you may need to help with this 
 
Bill James

Magic Smoke...The black smoke that has lived
inside your electronic device that was released just after you heard a pop
and the
thing shut off

[Iptablelog-users] Problem with mysql

[niconico <nic...@ti...>]

When i try to do the command

grant create temporary tables  on iptables.* iptables_user@localhost =
identified by 'xx';

it fails with error:

ERROR 1064: You have an error in your SQL syntax near '"create temporary =
tables" on iptables.* to iptables_user@localhost identified by' at line =
1

why?

I use mysql version 3.23.

Nicola

[Iptablelog-users] iptablelog

[Marc Q. <mqu...@fb...>]

I've looked through the archives at iptablelog's archive, but did not find a
complete answer. I did download a script ported to Redhat usage, which forgoes
the use of the start-stop-daemon. Thanks to Eric for that. I cannot rune
iptablelog because it's asking for dbi.pm. I go to install a dbi package, the
first one (1.30) does not contain dbi.pm, even though the file listing says it
doea, and the second install (1.32) is asking for libc.so.6(GLIBC_2.3), which
says it's for backwards compatibility for Redhat 6.3. Should I install this
GLIBC? Is there no end to the trail of old dependencies? GEEZ!

Marc

[Iptablelog-users] shorewall integration

[<dj...@mc...>]

Hi,

I'm trying to get iptables up and working with shorewall.
Are the LOG rule changes still required if using the feed_db-shorewall
script?  
I don't want to have to change my logfile format and iptables rules just
to support the log analyzer.  Is there a way to just drop native shorewall
logfiles into iptables using the feeder script to convert strings if 
necessary?  Has anyone made any changes to do this? 

If I do need to change my logfile format for iptables, where in shorewall
would I add these new rules to do this?  

Thanks!



----------------------------------------------------------------------
This mail sent through Toaster-Horde (http://qmailtoaster.clikka.com/)

[Iptablelog-users] Trouble with install/configure

[Brad V. S. <BVa...@ro...>]

I have the logger installed and I *thought* configured.  I can get to a
web page, but the page contains no logging data. =20

=20

Everything started up ok, so I don't know where to start looking for
problems.=20

=20

I'm on a Red Hat 9.0 system.

=20

Any suggestions?

=20

Brad Van Sickle

Network Administrator

RouteOne

bva...@ro...

Desk: 248-455-7085

Cell: 810-625-2941

=20

Re: [Iptablelog-users] Still in Development?

[gege <ge...@ge...>]

This project is not dead but I have very few time to work on it...
There is a lot of ideas to be implemented...
If you (or anyone else on the list) has time to work on it, do not 
hesitate to contact me !

Sorry for the poor reactivity and my lake of answer on questions...

Regards
Gérald

ziczac wrote:

>Hi,
>
>just a short question...
>
>Is this Project still in Development?
>
>thx
>
>
>
>
>-------------------------------------------------------
>This SF.Net email sponsored by: Free pre-built ASP.NET sites including
>Data Reports, E-commerce, Portals, and Forums are available now.
>Download today and enter to win an XBOX or Visual Studio .NET.
>http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
>_______________________________________________
>Iptablelog-users mailing list
>Ipt...@li...
>https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>
>  
>

[Iptablelog-users] Still in Development?

[ziczac <zi...@gm...>]

Hi,

just a short question...

Is this Project still in Development?

thx