RE: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Tail your log /var/log/iptables and make sure it is being populated with
iptables output.

Run the script Feed-db.pl manually, you should see output scroll across
the screen.

The --background is broken on newer linux installations (newer than
RH9), so use & when you want to fork it, "Feed-db.pl&"

Thanks,
Michael Brown,=20

-----Original Message-----
From: ipt...@li...
[mailto:ipt...@li...] On Behalf Of Johan
Koen
Sent: Monday, July 18, 2005 4:26 AM
To: Ipt...@li...
Subject: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php

Hi All=20

Please help with this one as I have been struggling for a week.=20

Everyting has been setup up correct but when I run feed-db.pl  it's just

sitting there doing nothing!?!=20
Can I set it up to log or give me some output?

Here is the script that came with the Installation which I have modified
to=20
work on my current system.=20

=20
 #!/usr/bin/perl

use strict;
use DBI;
use POSIX qw(strftime);

# IPTable log analyzer
# Copyright (C) 2002 Gerald GARCIA
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Plac<B2>e - Suite 330, Boston, MA
02111-1307,=20
USA.
#
# Contact author : ge...@ge...

# $Id: feed_db.pl,v 1.8 2002/11/12 20:43:18 gege Exp $

use Socket;

########################################################################
##############################
#################        C O N F I G     S E C T I O N            =20
###################################
########################################################################
##############################

my $dsn =3D 'DBI:mysql:iptables:localhost';
my $db_user_name =3D 'root';
my $db_password =3D '';
my $log_file =3D '/var/log/iptables';
my $pid_file =3D "/var/run/iptablelog.pid";

########################################################################
##############################
#################        E N D   O F   C O N F I G     S E C T I O N

###########################
########################################################################
##############################

my $go_to_background=3D($ARGV[0] eq '--background');

$SIG{INT} =3D \&got_int;

my ($id, $password);
my $dbh =3D DBI->connect($dsn, $db_user_name, $db_password);

# get the short name of months according to the locale
# thanks to Bill Garrett <memesis at users.sourceforge.net>
my(%m);
my($month_nb);
for $month_nb (0..11) {
    $m{strftime("%b", 0, 0, 0, 1, $month_nb,
96)}=3Dsprintf("%02d",$month_nb+1);
}

my($key);
foreach $key (keys %m) {
  print $key,"-",$m{$key},"\n";
}

my($log_tag)=3D"IPTABLES";

open(LOG_FILE,"tail -f $log_file 2>/dev/null |") or die "Unable to open
log=20
file $log_file : $!\n";

#fork to background
if ($go_to_background) {
  my($f) =3D fork();
  if (!defined($f)) { die "Unable to fork : $!\n"; }
  if($f) {
    # parent
    open(PID, ">$pid_file") or die "Unable to create pid file $pid_file:
$!";
    print PID "$f\n";
    close PID;
    exit(0);
  } else {
    # child
    close STDIN;
    open(STDIN, '</dev/null');
    close STDOUT;
    open(STDOUT, '>/dev/null');
    close STDERR;
    open(STDERR, '>/dev/null');
  }
}

while (<LOG_FILE>) {
  if (!/$log_tag/) { next; }
  my(@entry_split)=3Dsplit / +/;
  my(%entry);

  #year is not in syslog date format... try to guess it from the local
time
  # ***TODO*** what happen when the year change ?
  my($year);
  (undef,undef,undef,undef,undef,$year,undef,undef,undef) =3D
localtime(time);
  $year +=3D 1900;

=20
$entry{'date'}=3D"$year-".$m{shift(@entry_split)}."-".shift(@entry_split)=
.
"=20
".shift(@entry_split);
  $entry{'host'}=3Dshift(@entry_split);

  shift(@entry_split); # kernel:

  shift(@entry_split); # [IPTABLES

  my($chain_name)=3Dshift(@entry_split); # DROP]
  $chain_name=3D~s/\]//;

  shift(@entry_split); # :
  foreach (@entry_split) {
    if (/(.*)=3D(.*)/) {
      (my($field),my($value))=3Dsplit /=3D/;
      $entry{$field}=3D$value;
    }
  }
  my($iaddr) =3D inet_aton($entry{'SRC'});
  my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"SRC_NAME"}=3D$host_name; } else=20
{ $entry{"SRC_NAME"}=3D"unknown"; }

  open(HOST,"host $entry{'SRC'} |");
  my($result)=3D<HOST>;
  if ($result=3D~s/Name: (.*)$/$1/) {
    $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
  } else {
    if ($result=3D~s/.* pointer (.*)\.$/$1/) {
      $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
    } else { $entry{"SRC_NAME"}=3D"unknown"; }
  }
  close(HOST);

  my($iaddr) =3D inet_aton($entry{'DST'});
  my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"DST_NAME"}=3D$host_name; } else=20
{ $entry{"DST_NAME"}=3D"unknown"; }

  open(HOST,"host $entry{'DST'} |");
  my($result)=3D<HOST>;
  if ($result=3D~s/Name: (.*)$/$1/) {
    $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
  } else {
    if ($result=3D~s/.* pointer (.*)\.$/$1/) {
      $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
    } else { $entry{"DST_NAME"}=3D"unknown"; }
  }

  close(HOST);

=20
my($dummy)=3D"'".$entry{"host"}."','".$entry{"date"}."','".$chain_name."'=
,
'".
$entry{'IN'}."','".$entry{'SRC'}."','".$entry{'SRC_NAME'}."','".
$entry{'DST'}."','".$entry{'DST_NAME'}."','".$entry{'PROTO'}."','".
$entry{'SPT'}."','".$entry{'DPT'}."'";

  print "$dummy\n";

  $dbh->do("insert into logs
           (host,date,chain,interface_in, ip_src, name_src, ip_dest,=20
name_dest, proto, port_src, port_dest) values ($dummy)");

}
  $dbh->disconnect();

sub got_int {
    $SIG{INT} =3D \&got_int;          # but not for SIGCHLD!
    close(LOG_FILE);
}

-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. =
http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclick
_______________________________________________
Iptablelog-users mailing list
Ipt...@li...
https://lists.sourceforge.net/lists/listinfo/iptablelog-users