6

This is somewhat related to my previous question here.

I have three files in /etc/rsyslog.d which is included from /etc/rsyslog.conf:

  • 00-iptables.conf
  • 50-default.conf
  • postfix.conf

The first one is one that I created. My assumption is/was, that due to the naming it will be included before 50-default.conf, but I also tried putting the filter lines directly into 50-default.conf and remove my custom file (00-iptables.conf).

:msg, startswith, "ipt:" /var/log/iptables.log
& stop

Replaced ~ with stop as running rsyslogd with -N1 as described on the man page and in the troubleshooting steps gave a warning, saying ~ is deprecated in favor or stop, which means the available (official!) documentation seems to be outdated/lagging behind.

Now the idea here is that any message prefixed with ipt: will go into the named log file and no other log file will receive these lines (I tried also contains instead of startswith). That is in particular syslog and kern.log mentioned in 50-default.conf shouldn't receive those messages anymore:

auth,authpriv.*            /var/log/auth.log
*.*;auth,authpriv.none     -/var/log/syslog
kern.*                     -/var/log/kern.log

I read the rsyslog documentation, but documentation for the property-based filters (also here) isn't exactly the most enlightening. The example given in the documentation (also found elsewhere) and their Wiki gives a similar example:

# From documentation
*.* /var/log/allmsgs-including-informational.log
:msg, contains, "informational"  ~
*.* /var/log/allmsgs-but-informational.log
# From Wiki
:syslogtag, startswith, "MSWinEventLog#011" /var/log/messages;fixsnareFormat
& @192.168.1.8;fixsnareForwardFormat
& ~

While the example from the documentation isn't as close to my two-liner, it still explains the meaning of the ~ better.

What am I doing wrong?

Bonus points if someone can answer whether there is a way to combine selectors and properties. E.g.:

:msg, startswith, "ipt:" kern.* /var/log/iptables.log

NB: I use version 7.4.4 of rsyslog. And yes, I did service rsyslog restart after the changes and then waited for it to take effect.


Edit

Some more info. When running the daemon in debug mode (RSYSLOG_DEBUG=LogFuncFlow RSYSLOG_DEBUGLOG=~/rsl.log $(which rsyslogd) -f /etc/rsyslog.conf -d), I can see that the ruleset after optimization looks like this, which seems to indicate it's exactly the way I want it (leading prefix stripped for brevity):

ruleset 'RSYSLOG_DefaultRuleset' after optimization:
ruleset 0x214a640: rsyslog ruleset RSYSLOG_DefaultRuleset:
PROPFILT
   Property.: 'rawmsg'
   Operation: 'contains'
   Value....: 'ipt:'
THEN
  ACTION 0x215c070 [builtin:omfile:/var/log/iptables.log]
  STOP
END PROPFILT
PRIFILT 'auth,authpriv.*'
pmask:  X  X  X  X FF  X  X  X  X  X FF  X  X  X  X  X  X  X  X  X  X  X  X  X  X
  ACTION 0x215e840 [builtin:omfile:/var/log/auth.log]
END PRIFILT
PRIFILT '*.*;auth,authpriv.none'
pmask: FF FF FF FF  X FF FF FF FF FF  X FF FF FF FF FF FF FF FF FF FF FF FF FF FF
  ACTION 0x215f030 [builtin:omfile:-/var/log/syslog]
END PRIFILT

I should also add that from the behavior I see, I can deduce that the filter has an effect, as it clearly writes into the file /var/log/iptables.log as expected. However, the messages aren't dropped as expected after writing them to that particular file.

Here's an example line the way it ends up in all of kern.log, syslog and iptables.log as opposed to only the latter. Details have been redacted for privacy reasons:

Jun  1 02:23:01 hostname kernel: [70025.211497] ipt:drop IN=eth0 OUT=virbr0 MAC=dd:cc:bb:aa:99:88:77:66:55:44:33:22:11:00 SRC=9.8.7.6 DST=1.2.3.4 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=59201 DF PROTO=TCP SPT=47626 DPT=23 WINDOW=4380 RES=0x00 SYN URGP=0
  • Did you ever fix this? Experiencing a similar issue. – Aron Rotteveel Feb 10 '16 at 19:13
  • @AronRotteveel: nope, just checked. Have not been able to resolve this. – 0xC0000022L Feb 12 '16 at 9:26
1

Why not use RainerScript? Instead of the facility selector, match on $syslogfacility-text. In affect, this combines selectors and properties.

if ($msg startswith 'ipt:' and $syslogfacility-text == 'kern') then {
    action(type="omfile" file="/var/log/iptables.log")
    stop
}

Also note that the Rsyslog docs indicate the version 7 tree is outdated and should not be used (http://www.rsyslog.com/doc/v7-stable/).

0

not sure if you solved it or not. I did not go through all details but rsyslog can send messages in different ways depending on some configurations. For example it can send to all the conditions in the same time or it can send to first one and then to second and so on and so forth. If your settings are to send to all in the same time that stop will have no real meaning. Try to look for rsyslog asynchronous/synchronous/parallel and especially for direct/linkedlist type of queues which change the way rsyslog flow goes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.