syslog scanner

[Donny Jekels]

anyone know of a syslog scanner, floating around. looking for a tool/script perl || ksh to scan the syslog constantly looking for errors.

2 choices - build my own or get a working copy and build from there.

[Michael Tully · Accepted solution]

Hi Donny,

Check out these:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x836cc1c4ceddd61190050090279cd0f9,00.html
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x026250011d20d6118ff40090279cd0f9,00.html

http://www.shelldorado.com/
http://www.introcomp.co.uk/examples/index.html
http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/syslog_ng-1.5.8/
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/libol-0.2.23/

Cheers
Michael

[Steven E. Protter]

I wrote one looking for lbolts. It sends an email if it finds one. It could be run by cron on a regular basis.

Attached:

SEP

[Ben Thomas]

We use logcheck.sh. From the script:
#!/bin/sh
#
# logcheck.sh: Log file checker
# Written by Craig Rowland
#
# This file needs the program logtail.c to run
#
# This script checks logs for unusual activity and blatant
# attempts at hacking. All items are mailed to administrators
# for review. This script and the logtail.c program are based upon
# the frequentcheck.sh script idea from the Gauntlet(tm) Firewall
# (c)Trusted Information Systems Inc. The original authors are
# Marcus J. Ranum and Fred Avolio.
#
# Default search files are tuned towards the TIS Firewall toolkit
# the TCP Wrapper program. Custom daemons and reporting facilites
# can be accounted for as well...read the rest of the script for
# details.

Don't remember where it came from, but we centralize syslog data for about 25 systems and use this to manage it.

[Bill Hassell]

It is really difficult to generalize a syslog scanner as you have no control over the error message content. You can use a simple grep -i -e to find typical error flags:

grep -i -e warn -e err -e fail -e crit /var/adm/syslog/syslog.log

But to prevent seeing the same messages over and over, you need to:

1. compress and archive the current log and start a new log.

2. 'remember' the size of syslog (in lines) from the previous scan and start the new scan from lines+1 to the end.

3. Use logger to create a marker in the log foreach scan and start the new scan after the last marker.

As with any syslog scanner, you need to manually review the entries that are skipped in the log scanner to make sure important messages are not missed, and then adjust the grep -e options accordingly.