Re: Log Analysis and alerting
From: Dan Mercer (damercer@mmm.com)Date: 03/22/02
- Next message: Security Alert: "Sec, Vulnerability in VVOS Web proxy"
- Previous message: Subba Rao: "Re: Log Analysis and alerting"
- In reply to: Subba Rao: "Log Analysis and alerting"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: damercer@mmm.com (Dan Mercer) Date: 22 Mar 2002 17:07:22 GMT
In article <3c9b2ee1_1@news1.prserv.net>,
"Subba Rao" <sailorn@attglobal.net> writes:
> Hi
>
> I am trying setup a realtime alert system for our firewall. The
> firewall logs everything, so we have to process the logs twice
> to seperate the serious alerts. At the final stage there is still
> redundant information.
>
> For example, we want to monitor FTP, TELNET and IIS Webserver
> access attempts. For each protocol, there are several entries
> from the same host from different ports. My goal is to capture the
> first attempt (ignore the rest) and send an alert.
>
> What I am not able to do is to write the first attempt to a
> seperate log file. I plan to use swatch on this seperate log
> file to send the email alert. I am trying the following shell
> script to capture the first alert:
>
> root@log:/firewall/logs # tail -f fw1.log | awk -f alert.awk > email.log
>
> The alert.awk script is as follows:
>
> /IIS/ {
> #Get the current alert and current source IP address
> current = $3
> split($(NF-2),tmp,":")
> srcip = tmp[1]
>
> if ( attacks[$3] != srcip ) {
> print $_
> attacks[$3] = srcip
> }
> }
>
> Why does the awk script not write to the email.log?
Awk is writing to email.log, it just hasn't flushed the data
there yet. On Linux it won't until it has accumulated 4096
bytes, then it will just write the first 4096 bytes until the
next 4096 bytes are accumulated. By now you know that print $_
is incorrect. What you need to do is do the redirection within
the script:
# cat alert.awk
/IIS/ {
#Get the current alert and current source IP address
current = $3
split($(NF-2),tmp,":")
srcip = tmp[1]
if ( attacks[$3] != srcip ) {
print >> "email.log"
close("email.log")
attacks[$3] = srcip
}
}
# tail -f fw1.log | awk -f alert.awk
-- Dan Mercer damercer@mmm.com> > This is a very critical network. So, any help appreciated. > > Thank you in advance. > > -- > Subba Rao > sailorn@attglobal.net > >
Opinions expressed herein are my own and may not represent those of my employer.
- Next message: Security Alert: "Sec, Vulnerability in VVOS Web proxy"
- Previous message: Subba Rao: "Re: Log Analysis and alerting"
- In reply to: Subba Rao: "Log Analysis and alerting"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
