7

I have the following line in my /etc/rsyslog.conf

:programname, contains, "suhosin" /var/log/suhosin.log

which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I would like rsyslog to execute my script action.sh instead of logging to file. How could I do that?

4 Answers 4

9

You are looking for omprog.

module(load="omprog")
action(type="omprog"
       binary="/pathto/omprog.py --parm1=\"value 1\" --parm2=\"value2\"
       template="RSYSLOG_TraditionalFileFormat")

See the docs for more details: http://www.rsyslog.com/doc/v8-stable/configuration/modules/omprog.html

6

The following runs "hi.bash" for me if a message contains "hellothere"

:msg, regex, "hellothere" ^/usr/local/bin/hi.bash

According to the docs, it waits for it to finish, so although it works, I imagine it causes dropped events.

There's a way to send a Templated parameter, but I haven't played with it.

1
  • Worked great! Make sure hi.bash has appropriate execute rights for your situation (ie 755).
    – Kidquick
    Jun 1, 2018 at 23:59
2

Maybe you should use something like http://www.logcheck.org/ instead of running your script for each security incident via rsyslog.

1

Suhosin can execute a script for each log message. Example php.ini:

suhosin.log.script=255
suhosin.log.script.name=/usr/local/bin/action.sh

From the documentation: "The script is called with 2 parameters. The first one is the alert class in string notation and the second parameter is the log message."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .