To se mi líbí 0
Fork 0

Naposledy aktivní 2 months ago

nuno revidoval tento gist 2 months ago. Přejít na revizi

1 file changed, 344 insertions

gistfile1.txt(vytvořil soubor)

@@ -0,0 +1,344 @@
1 + root@wireguard:/# cat /etc/ulogd.conf
2 + # Example configuration for ulogd
3 + # Adapted to Debian by Achilleas Kotsis <[email protected]>
4 +
5 + [global]
6 + ######################################################################
7 + # GLOBAL OPTIONS
8 + ######################################################################
9 +
10 +
11 + # logfile for status messages
12 + logfile="syslog"
13 +
14 + # loglevel: debug(1), info(3), notice(5), error(7) or fatal(8) (default 5)
15 + loglevel=3
16 +
17 + ######################################################################
18 + # PLUGIN OPTIONS
19 + ######################################################################
20 +
21 + # We have to configure and load all the plugins we want to use
22 +
23 + # general rules:
24 + #
25 + # 0. don't specify any plugin for ulogd to load them all
26 + # 1. load the plugins _first_ from the global section
27 + # 2. options for each plugin in seperate section below
28 +
29 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inppkt_NFLOG.so"
30 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inppkt_ULOG.so"
31 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inppkt_UNIXSOCK.so"
32 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFCT.so"
33 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IFINDEX.so"
34 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2STR.so"
35 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2BIN.so"
36 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2HBIN.so"
37 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTPKT.so"
38 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_HWHDR.so"
39 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTFLOW.so"
40 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_MARK.so"
41 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_LOGEMU.so"
42 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SYSLOG.so"
43 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_XML.so"
44 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SQLITE3.so"
45 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_GPRINT.so"
46 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_NACCT.so"
47 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_PCAP.so"
48 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_PGSQL.so"
49 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_MYSQL.so"
50 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_DBI.so"
51 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_raw2packet_BASE.so"
52 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFACCT.so"
53 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_GRAPHITE.so"
54 + #plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_JSON.so"
55 +
56 + # this is a stack for logging packet send by system via LOGEMU
57 + stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU
58 +
59 + # this is a stack for packet-based logging via LOGEMU
60 + #stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU
61 +
62 + # this is a stack for ULOG packet-based logging via LOGEMU
63 + #stack=ulog1:ULOG,base1:BASE,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU
64 +
65 + # this is a stack for packet-based logging via LOGEMU with filtering on MARK
66 + #stack=log2:NFLOG,base1:BASE,mark1:MARK,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU
67 +
68 + # this is a stack for packet-based logging via GPRINT
69 + #stack=log1:NFLOG,base1:BASE,gp1:GPRINT
70 +
71 + # this is a stack for flow-based logging via LOGEMU
72 + #stack=ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,emu1:LOGEMU
73 +
74 + # this is a stack for flow-based logging via GPRINT
75 + #stack=ct1:NFCT,gp1:GPRINT
76 +
77 + # this is a stack for flow-based logging via XML
78 + #stack=ct1:NFCT,xml1:XML
79 +
80 + # this is a stack for logging in XML
81 + #stack=log1:NFLOG,xml1:XML
82 +
83 + # this is a stack for accounting-based logging via XML
84 + #stack=acct1:NFACCT,xml1:XML
85 +
86 + # this is a stack for accounting-based logging to a Graphite server
87 + #stack=acct1:NFACCT,graphite1:GRAPHITE
88 +
89 + # this is a stack for NFLOG packet-based logging to PCAP
90 + #stack=log2:NFLOG,base1:BASE,pcap1:PCAP
91 +
92 + # this is a stack for logging packet to MySQL
93 + #stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2bin1:IP2BIN,mac2str1:HWHDR,mysql1:MYSQL
94 +
95 + # this is a stack for logging packet to PGsql after a collect via NFLOG
96 + #stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,pgsql1:PGSQL
97 +
98 + # this is a stack for logging packet to JSON formatted file after a collect via NFLOG
99 + #stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,json1:JSON
100 +
101 + # this is a stack for logging packets to syslog after a collect via NFLOG
102 + #stack=log3:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,sys1:SYSLOG
103 +
104 + # this is a stack for logging packets to syslog after a collect via NuFW
105 + #stack=nuauth1:UNIXSOCK,base1:BASE,ip2str1:IP2STR,print1:PRINTPKT,sys1:SYSLOG
106 +
107 + # this is a stack for flow-based logging to MySQL
108 + #stack=ct1:NFCT,ip2bin1:IP2BIN,mysql2:MYSQL
109 +
110 + # this is a stack for flow-based logging to PGSQL
111 + #stack=ct1:NFCT,ip2str1:IP2STR,pgsql2:PGSQL
112 +
113 + # this is a stack for flow-based logging to PGSQL without local hash
114 + #stack=ct1:NFCT,ip2str1:IP2STR,pgsql3:PGSQL
115 +
116 + # this is a stack for flow-based logging to SQLITE3
117 + #stack=ct1:NFCT,sqlite3_ct:SQLITE3
118 +
119 + # this is a stack for logging packet to SQLITE3
120 + #stack=log1:NFLOG,sqlite3_pkt:SQLITE3
121 +
122 + # this is a stack for flow-based logging in NACCT compatible format
123 + #stack=ct1:NFCT,ip2str1:IP2STR,nacct1:NACCT
124 +
125 + # this is a stack for accounting-based logging via GPRINT
126 + #stack=acct1:NFACCT,gp1:GPRINT
127 +
128 + [ct1]
129 + #netlink_socket_buffer_size=217088
130 + #netlink_socket_buffer_maxsize=1085440
131 + #netlink_resync_timeout=60 # seconds to wait to perform resynchronization
132 + #pollinterval=10 # use poll-based logging instead of event-driven
133 + # If pollinterval is not set, NFCT plugin will work in event mode
134 + # In this case, you can use the following filters on events:
135 + #accept_src_filter=192.168.1.0/24,1:2::/64 # source ip of connection must belong to these networks
136 + #accept_dst_filter=192.168.1.0/24 # destination ip of connection must belong to these networks
137 + #accept_proto_filter=tcp,sctp # layer 4 proto of connections
138 +
139 + [ct2]
140 + #netlink_socket_buffer_size=217088
141 + #netlink_socket_buffer_maxsize=1085440
142 + #reliable=1 # enable reliable flow-based logging (may drop packets)
143 + hash_enable=0
144 +
145 + # Logging of system packet through NFLOG
146 + [log1]
147 + # netlink multicast group (the same as the iptables --nflog-group param)
148 + # Group O is used by the kernel to log connection tracking invalid message
149 + group=0
150 + #netlink_socket_buffer_size=217088
151 + #netlink_socket_buffer_maxsize=1085440
152 + # set number of packet to queue inside kernel
153 + #netlink_qthreshold=1
154 + # set the delay before flushing packet in the queue inside kernel (in 10ms)
155 + #netlink_qtimeout=100
156 +
157 + # packet logging through NFLOG for group 1
158 + [log2]
159 + # netlink multicast group (the same as the iptables --nflog-group param)
160 + group=1 # Group has to be different from the one use in log1
161 + #netlink_socket_buffer_size=217088
162 + #netlink_socket_buffer_maxsize=1085440
163 + # If your kernel is older than 2.6.29 and if a NFLOG input plugin with
164 + # group 0 is not used by any stack, you need to have at least one NFLOG
165 + # input plugin with bind set to 1. If you don't do that you may not
166 + # receive any message from the kernel.
167 + #bind=1
168 +
169 + # packet logging through NFLOG for group 2, numeric_label is
170 + # set to 1
171 + [log3]
172 + # netlink multicast group (the same as the iptables --nflog-group param)
173 + group=2 # Group has to be different from the one use in log1/log2
174 + numeric_label=1 # you can label the log info based on the packet verdict
175 + #netlink_socket_buffer_size=217088
176 + #netlink_socket_buffer_maxsize=1085440
177 + #bind=1
178 +
179 + [ulog1]
180 + # netlink multicast group (the same as the iptables --ulog-nlgroup param)
181 + nlgroup=1
182 + #numeric_label=0 # optional argument
183 +
184 + [nuauth1]
185 + socket_path="/tmp/nuauth_ulogd2.sock"
186 +
187 + [emu1]
188 + file="/var/log/ulog/syslogemu.log"
189 + sync=1
190 +
191 + [op1]
192 + file="/var/log/ulog/oprint.log"
193 + sync=1
194 +
195 + [gp1]
196 + file="/var/log/ulog/gprint.log"
197 + sync=1
198 + timestamp=1
199 +
200 + [xml1]
201 + directory="/var/log/ulog/"
202 + sync=1
203 +
204 + [json1]
205 + sync=1
206 + #file="/var/log/ulog/ulogd.json"
207 + #timestamp=0
208 + # device name to be used in JSON message
209 + #device="My awesome Netfilter firewall"
210 + # If boolean_label is set to 1 then the numeric_label put on packet
211 + # by the input plugin is coding the action on packet: if 0, then
212 + # packet has been blocked and if non null it has been accepted.
213 + #boolean_label=1
214 + # Uncomment the following line to use JSON v1 event format that
215 + # can provide better compatility with some JSON file reader.
216 + #eventv1=1
217 + # Uncomment the following lines to send the JSON logs to a remote host via UDP
218 + #mode="udp"
219 + #host="192.0.2.10"
220 + #port="10210"
221 + # Uncomment the following lines to send the JSON logs to a remote host via TCP
222 + #mode="tcp"
223 + #host="192.0.2.10"
224 + #port="10210"
225 + # Uncomment the following lines to send the JSON logs to a local unix socket
226 + #mode="unix"
227 + #file="/var/run/ulogd.socket"
228 +
229 + [pcap1]
230 + #default file is /var/log/ulogd.pcap
231 + #file="/var/log/ulog/ulogd.pcap"
232 + sync=1
233 +
234 + [mysql1]
235 + db="nulog"
236 + host="localhost"
237 + user="nupik"
238 + table="ulog"
239 + pass="changeme"
240 + procedure="INSERT_PACKET_FULL"
241 + # backlog configuration:
242 + # set backlog_memcap to the size of memory that will be
243 + # allocated to store events in memory if data is temporary down
244 + # and insert them when the database came back.
245 + #backlog_memcap=1000000
246 + # number of events to insert at once when backlog is not empty
247 + #backlog_oneshot_requests=10
248 +
249 + [mysql2]
250 + db="nulog"
251 + host="localhost"
252 + user="nupik"
253 + table="conntrack"
254 + pass="changeme"
255 + procedure="INSERT_CT"
256 +
257 + [pgsql1]
258 + db="nulog"
259 + host="localhost"
260 + user="nupik"
261 + table="ulog"
262 + #schema="public"
263 + pass="changeme"
264 + procedure="INSERT_PACKET_FULL"
265 + # connstring can be used to define PostgreSQL connection string which
266 + # contains all parameters of the connection. If set, this value has
267 + # precedence on other variables used to build the connection string.
268 + # See http://www.postgresql.org/docs/9.2/static/libpq-connect.html#LIBPQ-CONNSTRING
269 + # for a complete description of options.
270 + #connstring="host=localhost port=4321 dbname=nulog user=nupik password=changeme"
271 + #backlog_memcap=1000000
272 + #backlog_oneshot_requests=10
273 + # If superior to 1 a thread dedicated to SQL request execution
274 + # is created. The value stores the number of SQL request to keep
275 + # in the ring buffer
276 + #ring_buffer_size=1000
277 +
278 + [pgsql2]
279 + db="nulog"
280 + host="localhost"
281 + user="nupik"
282 + table="ulog2_ct"
283 + #schema="public"
284 + pass="changeme"
285 + procedure="INSERT_CT"
286 +
287 + [pgsql3]
288 + db="nulog"
289 + host="localhost"
290 + user="nupik"
291 + table="ulog2_ct"
292 + #schema="public"
293 + pass="changeme"
294 + procedure="INSERT_OR_REPLACE_CT"
295 +
296 + [pgsql4]
297 + db="nulog"
298 + host="localhost"
299 + user="nupik"
300 + table="nfacct"
301 + #schema="public"
302 + pass="changeme"
303 + procedure="INSERT_NFACCT"
304 +
305 + [dbi1]
306 + db="ulog2"
307 + dbtype="pgsql"
308 + host="localhost"
309 + user="ulog2"
310 + table="ulog"
311 + pass="ulog2"
312 + procedure="INSERT_PACKET_FULL"
313 +
314 + [sqlite3_ct]
315 + table="ulog_ct"
316 + db="/var/log/ulog/ulogd.sqlite3db"
317 +
318 + [sqlite3_pkt]
319 + table="ulog_pkt"
320 + db="/var/log/ulog/ulogd.sqlite3db"
321 +
322 + [sys2]
323 + facility=LOG_LOCAL2
324 +
325 + [nacct1]
326 + sync = 1
327 + #file = /var/log/ulog/nacct.log
328 +
329 + [mark1]
330 + mark = 1
331 +
332 + [acct1]
333 + pollinterval = 2
334 + # If set to 0, we don't reset the counters for each polling (default is 1).
335 + #zerocounter = 0
336 + # Set timestamp (default is 0, which means not set). This timestamp can be
337 + # interpreted by the output plugin.
338 + #timestamp = 1
339 +
340 + [graphite1]
341 + host="127.0.0.1"
342 + port="2003"
343 + # Prefix of data name sent to graphite server
344 + prefix="netfilter.nfacct"
Novější Starší

Vytvořeno pomocí Opengist ⋅ Load: 15ms⋅

Čeština
⋅ KrilHub