Re: Syslog and Prelude-lml client
Paul Robert Marino <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Well if possible try to use the prelude-lml's udp syslog listener capabilities its far more efficient then following a file, in addition ther would be no need to wory about file paths. An other option is using a glob /syslog/*/*/logfile.log. This will work but can flood you if you loose your meta data. The other problem with using a glob for this senario is you would monitor every days loggs al of the time. That's a lot of overhead. I don't think this would be the right method for the senario you described. You can also write a script to generate a file every day with the path to the log in it, then use a include statment in your configuration file. This method will require you to restart the lml nightly however its fairly simple. I've used all three of these methods successfully for various situations. On Tue, 29 Jan 2008 9:23 pm, Jimmy Tharel wrote: > I would like to program my prelude-lml client to read my firewall data > that is being sent to syslog. The problem I am having is that my > syslog logs in this format: > > /syslog/<YEAR>/<MONTH>/<DAY/logfile.log > i.e. /syslog/2008/01/29/logfile.log > > So, the firewall syslog writes to a new directory everyday. How do I > get the prelude-lml client to account for this? > > Thanks, > > Jimmy > > > > > ____________________________________________________________________________________ > Looking for last minute shopping deals? > Find them fast with Yahoo! Search. > http://tools.search.yahoo.com/newsearch/category.php?category=shopping > _______________________________________________ > Prelude-user site list > [email protected] > http://www.prelude-ids.org/mailman/listinfo/prelude-user ___________________________________________ The average person does a lot of work in the name of laziness! Save youre self the effort by doing it right the first time. Do it with free speech software. _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user