6

I have the following line in my /etc/rsyslog.conf

:programname, contains, "suhosin" /var/log/suhosin.log

which logs all php security related incidents to /var/log/suhosin.log. That is nice, but I would like rsyslog to execute my script action.sh instead of logging to file. How could I do that?

5

You are looking for omprog.

module(load="omprog")
action(type="omprog"
       binary="/pathto/omprog.py --parm1=\"value 1\" --parm2=\"value2\"
       template="RSYSLOG_TraditionalFileFormat")

See the docs for more details: http://www.rsyslog.com/doc/v8-stable/configuration/modules/omprog.html

2

Maybe you should use something like http://www.logcheck.org/ instead of running your script for each security incident via rsyslog.

2

The following runs "hi.bash" for me if a message contains "hellothere"

:msg, regex, "hellothere" ^/usr/local/bin/hi.bash

According to the docs, it waits for it to finish, so although it works, I imagine it causes dropped events.

There's a way to send a Templated parameter, but I haven't played with it.

  • Worked great! Make sure hi.bash has appropriate execute rights for your situation (ie 755). – Kidquick Jun 1 '18 at 23:59
1

Suhosin can execute a script for each log message. Example php.ini:

suhosin.log.script=255
suhosin.log.script.name=/usr/local/bin/action.sh

From the documentation: "The script is called with 2 parameters. The first one is the alert class in string notation and the second parameter is the log message."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.