Building Centralized

Logging: Syslog
Steven “Maniac” McGrath
 Syslog?

• logging service
• UNIX based
• Networkable
Wait a Sec...Network?

• UDP port 514

• Typically limited to 1024bytes
 One more thing...

• FIFO Buffers
• First In First Out
• Rolling View of Logs
• Type of Named Pipe
FIFO...Tasty *chomp*
3 Line FIFO Buffer
Item 5

Item 4
Item 3
Item 2

Item 1
 Getting Started...

• Ubuntu 6.06 Server

• Base Install
 Installing Syslog...
• Update The Repository
 Upgrade the OS
• We need to upgrade the OS to current.
 Install Syslog-NG
• Syslog-NG will remove klogd, this is normal.
Reconfiguring Syslog-ng
• Configuration depends on network
environment.
• Windows Hosts
• Cisco Devices
• Linux Hosts
• Other Devices and Gear
 First off...Global!
/etc/syslog-ng/syslog-ng.conf
options {
chain_hostnames(0);
time_reopen(10);
time_reap(360);
log_fifo_size(2048);
create_dirs(yes);
group(admin);
perm(0640);
dir_perm(0755);
use_dns(no);
stats_freq(0);
};

• Disable Hostname Chaining

• Time to wait before re-establishing a dead connection
• Time to wait before an idle file is closed
• FIFO Buffer size
• Create Directories
• Permissions
• Disable DNS
• Disable Statistic Logging
 Next, The Source
/etc/syslog-ng/syslog-ng.conf

source s_all {
internal();
unix-stream("/dev/log");
file("/proc/kmsg" log_prefix("kernel: "));
udp();
};
 Defining Filters

• Windows Filter
• Cisco Filter
 Windows Filter
/etc/syslog-ng/syslog-ng.conf

filter f_windows {
program(MSWinEventLog);
};
 Cisco Filter
/etc/syslog-ng/syslog-ng.conf

filter f_cisco_pix {
host(IP.OF.PIX.DEVICE);
};
 General Filter
/etc/syslog-ng/syslog-ng.conf

filter f_not_others {
not host(IP.OF.PIX.DEVICE)
and not program(MSWinEventLog);
};
 Destinations

• FIFO Buffers
• One Large File
 Windows FIFO
/etc/syslog-ng/syslog-ng.conf

destination d_windows {
pipe(“/var/log/buffers/windows”);
};
 Cisco FIFO
/etc/syslog-ng/syslog-ng.conf

destination d_cisco {
pipe(“/var/log/buffers/cisco”);
};
 General FIFO
/etc/syslog-ng/syslog-ng.conf

destination d_gen_fifo {
pipe(“/var/log/buffers/syslog”);
};
 ...And the Archive
/etc/syslog-ng/syslog-ng.conf

destination d_all {
file(“/var/log/arch/$MONTH$DAY$YEAR”);
};
 Tying it all Together!

• Now we tell syslog to handle the configs. ;)

 Windows Log
/etc/syslog-ng/syslog-ng.conf

log {
source(s_all);
filter(f_windows);
destination(d_windows);
};
 Cisco Log
/etc/syslog-ng/syslog-ng.conf

log {
source(s_all);
filter(f_cisco_pix);
destination(d_cisco);
};
 General FIFO
/etc/syslog-ng/syslog-ng.conf

log {
source(s_all);
filter(f_not_others);
destination(d_gen_fifo);
};
 Archive Log
/etc/syslog-ng/syslog-ng.conf

log {
source(s_all);
destination(d_all);
};
 Finishing up...

• Making the FIFO buffers

• Creating the directory structure
 Run me :)

$ sudo mkdir /var/log/arch

$ sudo mkdir /var/log/buffers

$ sudo mkfifo /var/log/buffers/windows

$ sudo mkfifo /var/log/buffers/cisco
$ sudo mkfifo /var/log/buffers/syslog
 Restart Syslog-ng

$ sudo /etc/init.d/syslog-ng restart

 Is it working?

• Check your Logfiles (/var/log/arch/*)

• Check your FIFO Buffers
• cat /var/log/buffers/windows

• cat /var/log/buffers/cisco

• cat /var/log/buffers/syslog
 Awsome! Wait....

• How are we gonna view this data?

 splunk>

• Web-based Interface
• Indexes arbitrary data
• Searchable
• Reporting
 splunk>

• No, I don’t work for them...I just really like

their product.
 Installing splunk>

• Download The latest version (3.0b3 as of

writing)
• Extract the tarball
• Run the application
• Make it startup with a system boot
 Installing splunk>
$ wget 'http://www.splunk.com/index.php/
download_track?file=/3.0b3/linux/
splunk-3.0b3-20872-Linux-
i686.tgz&ac=&wget=true&name=wget'

$ sudo mkdir /opt;cd /opt

$ sudo tar xzvf ~/splunk-3.0b3-20872-Linux-

i686.tgz

$ sudo /opt/splunk/bin
Configuring splunk>
Configuring splunk>
Configuring splunk>
Configuring splunk>
Configuring splunk>
splunk>
 Syslog Agents

• Windows Agents
• UNIX Agents
• Other Devices
 Windows Logs?

• SNARE Agent
• Converts Event Logs to Syslog
• Free
 UNIX Agents

• Use the syslog service!

• *.* @Syslog Server
 Other Devices

• Various systems can be configured

• Cisco, Juniper, Lotus Domino, Apache, IIS,
etc. are just a few examples.
 Recap

• What is Syslog
• What is FIFO
• Installing and Configuring Syslog-NG
• Installing and Configuring Splunk
• Agents
Questions?