Security :: Building An Opensource Syslog-SNMP Server With Web Interface?
Jun 16, 2010
I am looking to build a dedicated syslog-SNMP server with remote web interface and I would appreciate a discussion from our community on recommending the best solutions to deploy. I would like to be able to create an opensource architecture I could easily duplicate for multiple stand-alone customer environments.
Is it possible to configure the RHEL 5.5 syslog to accept SNMP traps? That is I want to use a central logging server to pick up other systems syslogs, and SNMP messages from systems that cannot use remote syslog functions.
I need to be able to send snmp traps based on certain severity or content of syslog messages. Can this be done from standard linux? Alternatively, are there MIB's out there that support syslog events so I can get the status from snmp?
I am looking for an open source syslog server which accumulate the each and every log of Windows, Solaris, Linux and network devices. Currently I am using Syslog-ng which is not fulfiling my requirement in Windows clients, as I need the logs of every action which user performed after logon.
I don't care so much the practicality and needlessness of actually setting up a computer for proxy server for personal usage, but none-the-less, i want to do it, and i'm just wondering about hardware.The proxy, i don't intend on having a desktop environment, so it'll be a terminal interface.But for a system that will handle traffic for 3 pc's and a ps3, how much hardware would one suggest i need, as far as RAM, HDD space, so on and so forth.
I was thinking it would be fun to do with with my old amd k6-2 processor and it's 32mb of ram, but in order for that pc to work, i'll need to replace a few hardware pieces, and before i dumb money into it and pull it out of the closet, i want to find out if it would even be worth my time to do it.
My parents have given me a free pass to play around with their old Saab 900 Turbo and what I'd really like to do is put a small linux computer in there as an experiment (and application, ultimately). For this to be a realistically useful project I really should make it interface with all the cars sensors and controls e.g. speedometer, fuel gauge, mileage, thermostat etc. I assume that since these are analogue meters they use an electromagnetic dial? It should be possible then (and without too much effort) to hook it up to an input device like the Arduino? I don't really know because it's been a long time since I studied electronics properly. I've already found a touch screen, I'm fairly sure I know what computer I'm going to use (SheevaPlug) and I'll probably use debian with xfce for the OS.
How to setup Dedicated Server for Web Hosting using Ubuntu Server or equivalent opensource Operating System? And how to make secured my Dedicated Server on public?
When I do...# iptables -L...I see rules in my INPUT and OUTPUT chains that look scary:ACCEPT all -- anywhere anywhere...but these rules only apply to the loopback interface. I tested it and the server cannot be reached on open ports from the outside world. How can I make iptables show the interfaces that the rules apply to?Otherwise, every time I do iptables -L it will scare the crap out of me.
CentOS 5.6 Server patched to latest, multiple name-based apache virtual hosts. SELinux OFF Everything was working fine until the other day. I've been making quite a lot of changes so it may well be something I've done, but I can't find out what! Last night I got the following in my logwatch : -
Requests with error response codes 404 Not Found /admin/phpmyadmin/scripts/setup.php: 1 Time(s) /admin/pma/scripts/setup.php: 1 Time(s) /admin/scripts/setup.php: 1 Time(s) /db/scripts/setup.php: 1 Time(s) /dbadmin/scripts/setup.php: 1 Time(s) [Code]...
The problem is that NONE of my logs, secure, httpd, messages, NONE of them, show any trace of these hacking attempts. They used to show up in secure and apache error logs, but no longer.
I was just looking around and did a tail on my syslog and some strange entries came up:
[Code].....
I'm a Verizon customer in Maryland, USA running Linux at my home and I don't understand why named is looking at servers in France and Saudi Arabia. Am I just being paranoid?
I have my system set up to where the router(dd-wrt) will send it's syslog messages to my Linux PC system. I am using shorewall as my firewall. I have two questions: How can I configure shorewall to allow the messages from my router? If I use my router IP address to allow the messages to come through the firewall, will this be a great security risk as anything from the internet can come through on that router ipaddress?
In order to mitigate risks linked to the use of the classic syslog protocol (spoof, replay, tampering, lost messages...) I am looking for a product implementing the syslog-sign capability: [URL] which is still a draft in the IETF for the moment. On NetBSD, the sylog daemon is able to run this feature: [URL]. Did anybody tried this feature on a Linux system?
I am searching that how i can configure syslogs/rsyslog to receive third party tools or softwares logs. For example i have a program that generates logs like when it is started and logs about its services, alerts if there are any alarms etc. I want to forward these logs using syslogs/rsyslog. Is their any possibility how can i achieve that
Failed login attempts are logged to syslog with the user id or login id set to UNKNOWN_USER or UNSET.Anybody know if this is configurable. I would rather it just pass the actual id that the user used. Doesn't matter if it exist or not, just want to know if someone is guessing at user names and what those user names are
I would like to monitor a RedHat via snmp. I would like to make available data via snmp. The data that I would like to graph are only present in logs file. Is it possible to parse data from applicative logs and have them available for my cacti server via snmp? I already monitor CPU, mem, and others with cacti using the standard MIB.What would be the logical step I would need to achieve that?
I am trying to configure SNMP server using xinetd on red hat. I am using non-standard port for it. My connection to server fails. I see the following log messages in /var/log:
Jan 26 17:23:31 [userid] xinetd[15023]: START: my-snmp pid=15047 from=192.128.11.21 Jan 26 17:23:31 [userid] xinetd[15023]: EXIT: my-snmp status=1 pid=15047 duration=0(sec) Jan 26 17:23:32 [userid] xinetd[15023]: START: my-snmp pid=15050 from=192.128.11.21 Jan 26 17:23:32 [userid] xinetd[15023]: EXIT: my-snmp status=1 pid=15050 duration=0(sec)
can anybody help to point out what is wrong in my config?
I have installed opennms and net-snmp-5.5 in ubuntu9.10.Both are working properly but, i dont know how to get snmpwalk,snmpget,snmpset outputs in opennms.
I am using orion snmp monitor in my network and I have no problem with windows systems but linux systems have some problem first of all snmp monitor shows cpu load on 100% all the time that is completely wrong and secong my snmp monitor can just show cpu and memory and response time information of linux systems and not disk information and nothing more. this is my /etc/snmp/snmpd.conf file content:
com2sec paranoid default public group MyROSystem v1 paranoid group MyROSystem v2c paranoid group MyROSystem usm paranoid group MyROGroup v1 readonly
wants to remove everything else that (presumably) has syslog as a dependency. how do I replace the dependency on syslog with a dependency on syslog-ng?
Im trying to get syslog-ng to log ssh stuff to a own file (later i want it to be forwarded to a other server but thats a later problem.
The thing is that if i restart my syslog-ng server and login with ssh, it logs it. but when i login again it dont. But if i restart the syslog-ng daemon again it logs again, but only once.
all I want is for my server to send hardware alerts to the snmp manager.
Is a snmpd.conf like this ok? rwcommunity name1 rocommunity name2 trapcommunity name3 trapsink ip_of_manager syscontact me syslocation my_addr_and_phone
i tried to configured snmp configuration for opennms monitoring tool to get disk alert ..when i entered the following command i doesint receive any sysobj id can somebody say how can i get my sysobjid in centos 5.4
I installed MRTG some hours ago. Everything works fine (disk, cpu,..), except the network graph. For this graph, it's only work for ~3 cycles (15min), then... nothing.
This is the part of mrtg.cfg:
Code:
The number for eth0 is 3
Code:
SNMP is running:
Code:
Crontab is configured for mrtg (and seems it's not the problem because the other graphs works well):
Code:
In attachement is the graph for the memory (working!) and .. for the network, as you can see, only one small pic at the beginning.
I noticed in my system that my root partition is getting full. I found a lot of old compacted syslogfiles. Had a look at etc/sysconfig editor eg cron but could not find a setting which allows to delete files older than a month. Where and how could I influence this ? I deleted manually all syslog files older than a month. Approx 6GB