analyza logu

[Dan Bar]

P. Pivonka napsal(a):
> Hi all,
> poradte mi prosim, jak reknu iptables aby logovaly do special file a
> ne do /var/log/messagess? 

ULOG - http://gnumonks.org/projects/ulogd

Ve starsich jadrech s tim pry byl nejaky problem. Jinak je to treba 
zvolit pri kompilaci kernelu:

"
ULOG target support
CONFIG_IP_NF_TARGET_ULOG
   This option adds a `ULOG' target, which allows you to create rules in
   any iptables table. The packet is passed to a userspace logging
   daemon using netlink multicast sockets; unlike the LOG target
   which can only be viewed through syslog.

   The appropriate userspace logging daemon (ulogd) may be obtained from
   http://www.gnumonks.org/projects/ulogd

"


Dale bych rad nejaky nastroj, ktery mi ten log
> spracuje na web nebo do nejakeho file, ktery je lepe citelny. 

Pouzivam tento,
fwlogwatch - http://cert.uni-stuttgart.de/projects/fwlogwatch/

> Taky bych
> chtel analyzovat squida kdo a kolik taha. Na to uz mi nekdo neco
> poradil. Ja bych ale potreboval nastroj, ktery mi zpracuje log ze
> squida, aby tam byl cas, odkud a kam. Pripadne klidne vystup na web, kam
> se leze nejvice a kdo je nejaktivnejsi v http prenosu.

Squid je schopen produkovat logy dvou typu - native squid log type a 
http like. (viz emulate_httpd_log config option)

calamaris - pouze textovy vystup
myslim ze i awstats - http://awstats.sourceforge.net/

Google - 
http://directory.google.com/Top/Computers/Software/Internet/Servers/Proxy/Caching/Squid/Logfile_Analysis/
http://directory.google.com/Top/Computers/Software/Internet/Site_Management/Log_Analysis/?tc=1

> 
> Pouzivam kernel 2.4.18, ale protoze ten stroj je cca 200 km
> upgradovat
> ho budu az budu nekdy na miste. Dale pouzivam iptables v1.2.6a, Squid
> Cache: Version 2.4.STABLE6, Apache/1.3.26 (Unix) Debian GNU/Linux a php
> 4.1.2.-6. Menit se mi to nechce nebot je to z distribuce Debianu.

Dan