Archive

Archive for June, 2009

Syslog-ng messages to bash script

June 22nd, 2009 No comments

I am falling more and more in love with syslog-ng. After some trial and error I’ve finally configured to parse messages and send them to zabbix for statistics logging. Sounds cool uh? Well it is.

Of course the posibilities are endless when you think about it. For me it is just sake to get performance messages from our application into zabbix to get triggered about problems.

Read further to found out how I did it
Read more…

Find evil hidden iframe’s

June 19th, 2009 No comments
find / -type f -name '*.htm' -exec egrep -H '<iframe src="(.*?)visibility: hidden' {} \;

And change .htm with every extension you suspect (php, html, js)

Tags: ,

Apache + SVN + LDAP

June 6th, 2009 No comments

Just because I always forget:

<VirtualHost 192.168.1.34:7000>
    <Location />

        DAV svn
        SVNPath /data/svn

        SVNReposName    "Subversion"
        AuthName        "Authenticate for Subversion"

        AuthType Basic
        AuthBasicProvider ldap
        AuthzLDAPAuthoritative on
        AuthLDAPUrl ldap://192.168.1.33/dc=kerneldump,dc=org?uid
        Require ldap-group cn=svnusers,ou=Group,dc=kerneldump,dc=org
        AuthLDAPGroupAttribute memberUid
        AuthLDAPGroupAttributeIsDN off
        Order deny,allow
        Allow from all

    CustomLog /var/log/httpd/svn_access_log combined
    ErrorLog  /var/log/httpd/svn_error_log
  </Location>
</VirtualHost>

Put this in an configuration file like mysvn.conf and include it in your httpd.conf file. This creates an virtualhost on port 7000 with immediately in the root the subversion repository. Of course you need to configure your LDAP configuration. Or need to use basic authentication.

For security purposes not every LDAP user is allowed, you need to be member of the svnusers group.

UPDATE Read more…

Tags: , , ,

Syslog-ng and MySQL

June 4th, 2009 6 comments

Just a quick note about Syslog-NG with an mysql backend.

# UDP Syslog Port Listener
source s_udp {
    udp(
        ip('192.168.0.1')
        port(514)
    );
};

# MySQL Destination
destination d_mysql {
    sql(
        type(mysql)
        host("server") username("syslog") password("syslog")
        database("syslog")
        table("logs")
        table("messages_${R_YEAR}${R_MONTH}${R_DAY}")
        columns("datetime", "host", "program", "pid", "message", "facility", "priority")
        values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY", "$FACILITY", "$LEVEL")
        indexes("datetime", "host", "program", "pid", "message", "facility", "priority")
    );
};

# Log the source to the destination, pretty straightforward
log {
    source(s_udp);
    destination(d_mysql);
};

As you can see it is a pretty easy configuration which turned out working great without any crappy connections like fifo’s. Besides that it creates a new table per day (it will create tables automatically), and thanks to the table per day tables stay fast enough for some more advanced features.

Off course this will work with every distribution (ubuntu, centos, redhat, suse, archlinux) where you can install the binaries of syslog-ng which include the necessary MySQL libraries as you can see in the comments below

Tags: , ,