Re: [PATCH] prelude plugin for specter

Note: This is a resend, because a network problem caused my mailserver
to send the last version of this mail without the patch.

Maik Hentsche <[email protected]> wrote:

> Hi,
> I'm currently working on getting firewall (netfilter/iptables)
> logmessages into prelude. For this is wrote a plugin for specter
> (http://joker.linuxstuff.pl/specter/), a daemon, that handles
> logging through the ULOG target (as ulogd does, if anyone knows
> that).

I've been away from prelude development longer than I have wished to
but now I am proud to present an improved version of my patch. Find it
attached. I took all suggestion I got for the first version of my
patch and I feel that it is much improved now. I'd appreciate if you
could give it a try and tell me what you think about it. All
suggestions, criticisms and suggestions are valuable. 

Even though I think the plugin is usable as it is, I'm planning for
some improvements in the future. One of this is a way for the
administrator to influence the verboseness of the syslog mode.
Furthermore, I'm not sure if it is possible for some fields like IP
addresses to have NULL pointers if pred_init() returned successfully.
I'm going to evaluate this. 


so long
Maik

-- 
Maik Hentsche <[email protected]>

http://chemitzer.linux-tage.de

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel