Re: mysql prelude-lml rules

On Fri, 2006-09-15 at 15:34 +0200, joël Winteregg wrote:
> Here is the rulset i wrote to grab strange mysql queries from its "clear
> text" logging capability, configured as follow in /etc/mysql/my.cnf:
> 
> log = /var/log/mysql.log
> 
> 
> The following format configuration need to be done to be able to manage
> this kind of logs which doesn't always follow the same template (when
> multiple queries are done in a single one separated by ';'):
> 
> [format=mysql]
> time-format = "%y%m%d %H:%M:%S"
> prefix-regex = "^(?:(?P<timestamp>[\d: ]{15})|)"
> file = /var/log/mysql.log
> 
> Here is the related plugins.rules configuration:
> # source                     plugin-name-list      pcre-options
> regex
> #
> # *                          Debug
> -                    .*
>  /var/log/mysql.log          Pcre[mysql]
> -                    .*
> 
> 
> 
> Rules are done as a blacklist which try to focus on "strange SQL
> queries" which are often use for SQL injection purpose ;-)
> 
> I will be happy to have a feedback about it (to know if i forgot some
> important "strange SQL queries"). Rules which fetch all log lines are by
> default commented (to avoid flooding).

Hi Joël,

Thanks a lot for your contribution. 

Gene Ramon Gomez <[email protected]>, the LML ruleset maintainer,
will review the ruleset and contact you regarding it's inclusion in the
Prelude-LML distribution.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel