6

I have the following line in my /etc/rsyslog.conf

:programname, contains, "suhosin" /var/log/suhosin.log

which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I would like rsyslog to execute my script action.sh instead of logging to file. How could I do that?

6

You are looking for omprog.

module(load="omprog")
action(type="omprog"
       binary="/pathto/omprog.py --parm1=\"value 1\" --parm2=\"value2\"
       template="RSYSLOG_TraditionalFileFormat")

See the docs for more details: http://www.rsyslog.com/doc/v8-stable/configuration/modules/omprog.html

| improve this answer | |
4

The following runs "hi.bash" for me if a message contains "hellothere"

:msg, regex, "hellothere" ^/usr/local/bin/hi.bash

According to the docs, it waits for it to finish, so although it works, I imagine it causes dropped events.

There's a way to send a Templated parameter, but I haven't played with it.

| improve this answer | |
  • Worked great! Make sure hi.bash has appropriate execute rights for your situation (ie 755). – Kidquick Jun 1 '18 at 23:59
2

Maybe you should use something like http://www.logcheck.org/ instead of running your script for each security incident via rsyslog.

| improve this answer | |
1

Suhosin can execute a script for each log message. Example php.ini:

suhosin.log.script=255
suhosin.log.script.name=/usr/local/bin/action.sh

From the documentation: "The script is called with 2 parameters. The first one is the alert class in string notation and the second parameter is the log message."

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.