Re: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php

[Stephen D. <ste...@gm...>]

Michael Brown always brings his "A" game. I agree, your best bet is to run=
=20
the feed_db.pl script in a console and see what it spits out at you.If it=
=20
says nothing then the problem is most likely that there is nothing in=20
/var/log/iptables. Therefore you need to check that iptables is indeed=20
logging to /var/log/iptables. You only provided one piece of the puzzle wit=
h=20
your config. Are you sure your iptables script is logging correctly? Is you=
r=20
logging daemon setup correctly to log iptable messages to /var/log/iptables=
?=20
You said "Everything has been setup correct" but I don't think you can say=
=20
such a thing with confidence when it doesn't provide the results you want. =
I=20
suppose I am just rambling. When in doubt follow Michael Browns advice.
 Stephen G Dailey

 On 7/18/05, Brown, Michael D <Mic...@fn...> wrote:=20
>=20
> Tail your log /var/log/iptables and make sure it is being populated with
> iptables output.
>=20
> Run the script Feed-db.pl manually, you should see output scroll across
> the screen.
>=20
> The --background is broken on newer linux installations (newer than
> RH9), so use & when you want to fork it, "Feed-db.pl&"
>=20
> Thanks,
> Michael Brown,
>=20
>=20
> -----Original Message-----
> From: ipt...@li...
> [mailto:ipt...@li...] On Behalf Of Johan
> Koen
> Sent: Monday, July 18, 2005 4:26 AM
> To: Ipt...@li...
> Subject: [Iptablelog-users] Feed-db.pl & Feed-db-suse.php
>=20
> Hi All
>=20
> Please help with this one as I have been struggling for a week.
>=20
> Everyting has been setup up correct but when I run feed-db.pl it's just
>=20
> sitting there doing nothing!?!
> Can I set it up to log or give me some output?
>=20
>=20
> Here is the script that came with the Installation which I have modified
> to
> work on my current system.
>=20
>=20
> #!/usr/bin/perl
>=20
> use strict;
> use DBI;
> use POSIX qw(strftime);
>=20
> # IPTable log analyzer
> # Copyright (C) 2002 Gerald GARCIA
> #
> # This program is free software; you can redistribute it and/or
> # modify it under the terms of the GNU General Public License
> # as published by the Free Software Foundation; either version 2
> # of the License, or (at your option) any later version.
> #
> # This program is distributed in the hope that it will be useful,
> # but WITHOUT ANY WARRANTY; without even the implied warranty of
> # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> # GNU General Public License for more details.
> #
> # You should have received a copy of the GNU General Public License
> # along with this program; if not, write to the Free Software
> # Foundation, Inc., 59 Temple Plac<B2>e - Suite 330, Boston, MA
> 02111-1307,
> USA.
> #
> # Contact author : ge...@ge...
>=20
> # $Id: feed_db.pl,v 1.8 2002/11/12 20:43:18 gege Exp $
>=20
> use Socket;
>=20
>=20
> ########################################################################
> ##############################
> ################# C O N F I G S E C T I O N
> ###################################
> ########################################################################
> ##############################
>=20
> my $dsn =3D 'DBI:mysql:iptables:localhost';
> my $db_user_name =3D 'root';
> my $db_password =3D '';
> my $log_file =3D '/var/log/iptables';
> my $pid_file =3D "/var/run/iptablelog.pid";
>=20
> ########################################################################
> ##############################
> ################# E N D O F C O N F I G S E C T I O N
>=20
> ###########################
> ########################################################################
> ##############################
>=20
>=20
> my $go_to_background=3D($ARGV[0] eq '--background');
>=20
> $SIG{INT} =3D \&got_int;
>=20
> my ($id, $password);
> my $dbh =3D DBI->connect($dsn, $db_user_name, $db_password);
>=20
>=20
> # get the short name of months according to the locale
> # thanks to Bill Garrett <memesis at users.sourceforge.net<http://users.s=
ourceforge.net>
> >
> my(%m);
> my($month_nb);
> for $month_nb (0..11) {
> $m{strftime("%b", 0, 0, 0, 1, $month_nb,
> 96)}=3Dsprintf("%02d",$month_nb+1);
> }
>=20
> my($key);
> foreach $key (keys %m) {
> print $key,"-",$m{$key},"\n";
> }
>=20
>=20
> my($log_tag)=3D"IPTABLES";
>=20
> open(LOG_FILE,"tail -f $log_file 2>/dev/null |") or die "Unable to open
> log
> file $log_file : $!\n";
>=20
>=20
> #fork to background
> if ($go_to_background) {
> my($f) =3D fork();
> if (!defined($f)) { die "Unable to fork : $!\n"; }
> if($f) {
> # parent
> open(PID, ">$pid_file") or die "Unable to create pid file $pid_file:
> $!";
> print PID "$f\n";
> close PID;
> exit(0);
> } else {
> # child
> close STDIN;
> open(STDIN, '</dev/null');
> close STDOUT;
> open(STDOUT, '>/dev/null');
> close STDERR;
> open(STDERR, '>/dev/null');
> }
> }
>=20
>=20
>=20
> while (<LOG_FILE>) {
> if (!/$log_tag/) { next; }
> my(@entry_split)=3Dsplit / +/;
> my(%entry);
>=20
> #year is not in syslog date format... try to guess it from the local
> time
> # ***TODO*** what happen when the year change ?
> my($year);
> (undef,undef,undef,undef,undef,$year,undef,undef,undef) =3D
> localtime(time);
> $year +=3D 1900;
>=20
>=20
> $entry{'date'}=3D"$year-".$m{shift(@entry_split)}."-".shift(@entry_split)=
.
> "
> ".shift(@entry_split);
> $entry{'host'}=3Dshift(@entry_split);
>=20
> shift(@entry_split); # kernel:
>=20
> shift(@entry_split); # [IPTABLES
>=20
> my($chain_name)=3Dshift(@entry_split); # DROP]
> $chain_name=3D~s/\]//;
>=20
> shift(@entry_split); # :
> foreach (@entry_split) {
> if (/(.*)=3D(.*)/) {
> (my($field),my($value))=3Dsplit /=3D/;
> $entry{$field}=3D$value;
> }
> }
> my($iaddr) =3D inet_aton($entry{'SRC'});
> my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
> if (defined($host_name)) { $entry{"SRC_NAME"}=3D$host_name; } else
> { $entry{"SRC_NAME"}=3D"unknown"; }
>=20
> open(HOST,"host $entry{'SRC'} |");
> my($result)=3D<HOST>;
> if ($result=3D~s/Name: (.*)$/$1/) {
> $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
> } else {
> if ($result=3D~s/.* pointer (.*)\.$/$1/) {
> $result=3D~s/\n//; $entry{"SRC_NAME"}=3D$result;
> } else { $entry{"SRC_NAME"}=3D"unknown"; }
> }
> close(HOST);
>=20
> my($iaddr) =3D inet_aton($entry{'DST'});
> my($host_name) =3D gethostbyaddr($iaddr, AF_INET);
> if (defined($host_name)) { $entry{"DST_NAME"}=3D$host_name; } else
> { $entry{"DST_NAME"}=3D"unknown"; }
>=20
> open(HOST,"host $entry{'DST'} |");
> my($result)=3D<HOST>;
> if ($result=3D~s/Name: (.*)$/$1/) {
> $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
> } else {
> if ($result=3D~s/.* pointer (.*)\.$/$1/) {
> $result=3D~s/\n//; $entry{"DST_NAME"}=3D$result;
> } else { $entry{"DST_NAME"}=3D"unknown"; }
> }
>=20
> close(HOST);
>=20
>=20
> my($dummy)=3D"'".$entry{"host"}."','".$entry{"date"}."','".$chain_name."'=
,
> '".
> $entry{'IN'}."','".$entry{'SRC'}."','".$entry{'SRC_NAME'}."','".
> $entry{'DST'}."','".$entry{'DST_NAME'}."','".$entry{'PROTO'}."','".
> $entry{'SPT'}."','".$entry{'DPT'}."'";
>=20
> print "$dummy\n";
>=20
>=20
> $dbh->do("insert into logs
> (host,date,chain,interface_in, ip_src, name_src, ip_dest,
> name_dest, proto, port_src, port_dest) values ($dummy)");
>=20
>=20
> }
> $dbh->disconnect();
>=20
> sub got_int {
> $SIG{INT} =3D \&got_int; # but not for SIGCHLD!
> close(LOG_FILE);
> }
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dclic=
k
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id=16492&opclick
> _______________________________________________
> Iptablelog-users mailing list
> Ipt...@li...
> https://lists.sourceforge.net/lists/listinfo/iptablelog-users
>