Honeypots
Send strace output through syslog-ng Aug 04 2009 07:38PM
BB@umd (bbenard umd edu) (3 replies)

Good afternoon.

I have a honeypot which syslog-ng running. I configured it so that it can
send all the log files to a remote web server. (So that mean I have already
configured syslog-ng on this web server too) No matter with that, it works
great.

Then, on my honeypot, I have a strace command attached to my ssh server. It
gathers strace outputs in a strace.log file. Here is this command :
strace -f -q -p `cat /var/run/sshd.pid` -o /var/log/strace.log &

Now, I would like to send the strace output (/var/log/strace.log) to my
server through syslog-ng. So, on my honeypot, I added the following in my
syslog-ng.conf in the source section:
file ("/var/log/strace.log").

However, now, on the server side, I do not know how to configure syslog-ng
in order to retrieve this strace output only. Is there a special filter for
strace in syslog-ng ? (Usually, for example, I am using "filter {
facility(auth);};" to filter auth.log : so is there something similar with
strace ?)

Regards,
BB

--
View this message in context: http://www.nabble.com/Send-strace-output-through-syslog-ng-tp24814871p24
814871.html
Sent from the Honeypots mailing list archive at Nabble.com.

[ reply ]
Re: Send strace output through syslog-ng Aug 05 2009 02:08PM
BB@umd (bbenard umd edu)
Re: Send strace output through syslog-ng Aug 05 2009 12:52PM
Gergely Révay (gergely revay gmail com)
Re: Send strace output through syslog-ng Aug 05 2009 12:33AM
Chris Brenton (cbrenton chrisbrenton org)


 

Privacy Statement
Copyright 2010, SecurityFocus