summaryrefslogtreecommitdiffstats
path: root/ulogd.conf.in
Commit message (Collapse)AuthorAgeFilesLines
* ulogd.conf: slightly expand documentation on zerocounter option for nfacctPablo Neira Ayuso2012-08-031-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfacct: add timestamp optionEric Leblond2012-08-031-0/+3
| | | | | | | | | This patch adds a timestamp option to the nfacct plugin. If activated, nfacct output a timestamp which is computed just after sending the nfacct request. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pgsql schema: add nfacct tableEric Leblond2012-08-031-0/+8
| | | | | | | | This patch adds a nfacct table to the postgresql schema. It enables the storage of all counters at each poll. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfacct: add variable to not zero counter after readEric Leblond2012-08-031-0/+2
| | | | | | | | | | | | The default nfacct input plugin zeroes counter after each read. This is a limitation as other software can't use the counter at the same time as ulogd2. This patch adds the zerocounter variable to the NFACCT input plugin. If set to zero, the counters are not zeroed. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: support for NFACCT input pluginPablo Neira Ayuso2012-06-221-0/+3
| | | | | | | | | This patch extends XML plugin to support NFACCT. You can use the following line in ulogd.conf to test it: stack=acct1:NFACCT,xml1:XML Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-181-24/+24
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: add `reliable' config option to enable reliable flow-based loggingPablo Neira Ayuso2012-03-051-0/+1
| | | | | | | | | | | | Reliability comes at the cost of dropping new flows if the destroy event that ctnetlink delivers to us is lost. Under heavy stress this may imply dropping packets, you've been warned. If you do want not to lose one single flow-logging information, enable this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add example use of GPRINT to ulogd.conf.in configuration filePablo Neira Ayuso2012-02-221-3/+5
| | | | | | | | | | | | | | | Example on how this display one conntrack: timestamp=2012/02/22-13:16:54,orig.ip.saddr=192.168.1.129,orig.ip.daddr=173.194.34.235,orig.ip.protocol=6,orig.l4.sport=58221,orig.l4.dport=80,orig.raw.pktlen=1206,orig.raw.pktcount=4,reply.ip.saddr=173.194.34.235,reply.ip.daddr=192.168.1.129,reply.ip.protocol=6,reply.l4.sport=80,reply.l4.dport=58221,reply.raw.pktlen=1104,reply.raw.pktcount=3,ct.mark=0,ct.id=846180008,ct.event=4,flow.end.sec=1329913014,flow.end.usec=413771,oob.family=2,oob.protocol=0 and one NFLOG line look like this timestamp=2012/02/22-13:21:24,raw.pktlen=40,raw.pktcount=1,oob.prefix=test,oob.time.sec=1329913284,oob.time.usec=226795,oob.mark=0,oob.ifindex_in=3,oob.hook=1,raw.mac_len=14,oob.family=2,oob.protocol=2048,raw.label=0,raw.type=1,raw.mac.addrlen=6 People that like parsing comma-separated key-value files will like this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: add nfacct pluginPablo Neira Ayuso2012-02-221-0/+7
| | | | | | This patch adds the nfacct plugin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: add GPRINT pluginPablo Neira Ayuso2012-02-221-0/+6
| | | | | | | | | | This patch adds GPRINT which is a generalization of OPRINT. It display the set of key-values separated by commas. This is the generic print that you can attach to whatever kind of input plugin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* A simple filter plugin called IP2HBIN addedJozsef Kadlecsik2012-01-161-0/+1
| | | | | | | | The plugin converts the IPv4 addresses to host order for databases like MySQL. The expected name of the table fields are ip.hsaddr, ip.hdaddr, etc. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* pcap: add file option to configuration fileEric Leblond2011-09-011-0/+2
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* sqlite3: add configuration examples and new tables layoutPablo Neira Ayuso2011-02-251-0/+16
| | | | | | | | | | This patch adds two configuration examples for sqlite3 to log flows and packets. We use two tables, one for packet logging information, and another for flow-based information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* config: add file option for NACCT pluging to the example config filePablo Neira Ayuso2011-02-241-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use appropriate location for program modulesJan Engelhardt2011-02-011-21/+21
| | | | | | | Modules - since they are dependent on the executable - generally go to libexec/. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Add new input plugin UNIXSOCKPierre Chifflier2010-10-231-0/+7
| | | | | | | | | This input plugins creates a unix socket which can be used to log packets. Scripts or applications can connect to the socket (only one client allowed per socket) and send data in a Key-Length-Value format (including the payload). Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
* ulogd.conf: fix mysql definition for NFCTEric Leblond2010-09-221-1/+1
| | | | Mysql definition for NFCT usage was not correct.
* output: add new plugin XML to output logs in XMLPablo Neira Ayuso2010-06-171-0/+11
| | | | | | | This patch adds XML that allows to log information in XML for ulogd2. It supports packet and flow-based accounting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: change `pollinterval' behaviourPablo Neira Ayuso2010-01-171-0/+1
| | | | | | | | | | | | | | | This patch adds support for poll-based logging. Basically, ulogd polls from the kernel periodically to log entries. You can use the `pollinterval' option in the configuration file to set the polling period. This patch changes the current behaviour of `pollinterval' that allowed to mix both the event-driven logging with polling periodically from the kernel. I have tried to look for anyone in google (and asking Eric Leblond) using this feature but I found noone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: add configurable option to set the value of the resynchronization timerPablo Neira Ayuso2009-07-221-0/+1
| | | | | | | | | This patch adds `netlink_resync_timeout' that allows you to set the number of seconds that we wait to perform a resynchronization due to a netlink overrun. This patch changes the default timeout from 2 to 60 seconds (less agressive). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nflog: adjust unit which was inaccurate.Eric Leblond2009-03-061-2/+2
| | | | | Timeout unit is 10ms and not 1ms. This patch fixes an invalid comment in the configuration file.
* Add threshold and timeout option to NFLOG plugin.Eric Leblond2009-01-291-0/+4
| | | | | This patch adds support for setting NFLOG threshold and timeout from ulogd.
* fix config file: MAC2STR has been renamed to HWHDR.Eric Leblond2009-01-131-2/+2
| | | | | This patch replaces all MAC2STR occurences by HWHDR to sync with the renaming of the plugin.
* Add variable to force binding of nfnetlink_log.Eric Leblond2009-01-051-0/+6
| | | | | | | | | | | | | This patch updates the behaviour of the NFLOG input plugin to fix an issue related to kernel older than 2.6.29. The call to nflog_bind_pf() that can be necessary to receive packet from the nfnetlink_log was only done if the used group was 0 (system logging). This is logic for the newest kernel (NFLOG really sends message to nfnetlink_log and not to the nf_log logger). But this is unsufficient for older one. By forcing the binding with the new configuration variable bind, it is now possible to trigger the binding from the ulogd2 configuration file. This gives users a way to be sure that ulogd will receive packets if the NFLOG input plugin is used.
* Document group 0 usage and suppress address_familyEric Leblond2008-12-091-17/+20
| | | | | | | | Document the fact that group 0 is used by system logging and update stack and plugin definition to match the suppression of the address_family variable. Signed-off-by: Eric Leblond <eric@inl.fr>
* Add new output plugin DBIPierre Chifflier2008-12-091-0/+10
| | | | | | | | | libdbi implements a database-independent abstraction layer in C, similar to the DBI/DBD layer in Perl. This module brings support for all database types supported by libdbi. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
* hwhdr: finish missing renamingPierre Chifflier2008-10-201-1/+1
| | | | | | | MAC2STR has been renamed to HWHDR. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* config: remove obsolete global variablesEric Leblond2008-09-121-7/+0
| | | | | | | | | 'rmem' and 'bufsize' global variables are unherited from ulogd1 and are not used anymore. This patch suppresses them from the example configuration file. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Update configfile for MARK moduleEric Leblond2008-06-121-1/+8
| | | | | | Add stack example for MARK and update some wrong stacks. Signed-off-by: Eric Leblond <eric@inl.fr>
* adds some examples to the configuration fileEric Leblond2008-06-021-0/+36
|
* improve overrun handling NFLOGPablo Neira Ayuso2008-06-021-0/+2
| | | | | | | | This patch improves the overrun handling. The NFLOG plugin duplicates the netlink buffer size if the size does not goes after the upper boundary. This patch also introduces two new clauses, the netlink_socket_buffer_size and netlink_socket_buffer_maxsize that set the size of the netlink socket buffer.
* improve netlink overrun handling of NFCTPablo Neira Ayuso2008-06-021-0/+2
| | | | | | | | | | | | | | | This patch improves the overrun handling. The logic behind this patch consists of two steps: 1) duplicate the netlink buffer size if the size does not goes after the upper boundary. 2) scheduling a resynchronization (in two seconds) with the kernel conntrack table if we hit ENOBUFS. During the resynchronization, the NFCT plugin dumps the current table and purges the objects that do not exist anymore. This patch also introduces two new clauses, the netlink_socket_buffer_size and netlink_socket_buffer_maxsize that set the size of the netlink socket buffer.
* This patchset adds support for the "numeric_label" option. For instance, it/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-291-0/+2
| | | | | | | can be used to determine if the packet has been dropped, rejected or accepted. The meaning of label is completely user-defined. Signed-off-by: Eric Leblond <eric@inl.fr>
* example for logging IPv6 packet to PGsql after a collect via NFLOG/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-131-1/+2
| | | | Signed-off-by: Anton Vazir <anton.vazir@gmail.com>
* This patch adds some example to the default configuration file. It modify/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-2/+9
| | | | | | some stack to take my latest patches into account. Signed-off-by: Eric Leblond <eric@inl.fr>
* This patch updates included configuration file example by adding some plugins/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-261-0/+11
| | | | | | loading and stack example. Signed-off-by: Eric Leblond <eric@inl.fr>
* This patch adds a sample configuration for logging with ebtables through ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-1/+15
| | | | | | nflog out to LOGEMU and SYSLOG. It also fixes a config bug with ipv6 (log2) Signed-off-by: Peter Warasin <peter@endian.com>
* Eric Leblond <eric@inl.fr>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-101-4/+13
| | | | Document the difference between IPv4 and IPv6 logging.
* From: Eric Leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-091-9/+21
| | | | | | This patch adds some examples of stack to the configuration file. It also fixes some comments to avoid confusion. IP2BIN has been added to the list of loaded modules.
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-1/+9
| | | | | - This patch suppress key relative to IPv6 address because IPv4 and IPv6 can be stored in the same key. - Add missing IP2STR line to ulogd.conf.in
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-0/+7
| | | | | | | | | This patch adds new SQL schema for MySQL and PGsql. The goal is to improve the one line per entry format. There is no more a big table with all fields because this sort of storage is causing bad performance (databases don't like to have a lot of NULL fields to store). Main changes are : * Add new schema for MySQL and PGsql * Use call to configurable procedure in SQL OUTPUT modules * Arguments of a procedure are given by the list of fields of a selected table
* [PATCH]: ulogd2: fix ULOG input plugin/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-041-0/+6
| | | | | | | The ULOG input plugin of ulogd2 was not working. This patch fixes this and cleans the code via introduction of an enum. Eric Leblond <eric@inl.fr>
* Eric Leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-031-0/+2
| | | | | | | - add a call to autoheader which is needed to compile ulogd2 from subversion. - add a warning message to ulogd2 when it exits on error. It simply tell to look at the configuration file. - add an empty section which is needed to have NFCT logging working.
* Add a printflow plugin is similar to the PRINTPKT plugin, but for flows. It's/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-05-231-0/+4
| | | | output is compatible with the SYSLOG and LOGEMU plugins. (Philip Craig)
* Move the printpkt functionality out of SYSLOG and LOGEMU, and into/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-05-231-1/+2
| | | | | a separate PRINTPKT plugin. This reduces code duplication, and also makes the SYSLOG and LOGEMU plugins more general. (Philip Craig)
* it's now called "group" parameter, not nlgrouplaforge2005-11-241-1/+1
|
* distribute a reasonable config file templatelaforge2005-11-051-36/+20
|
* new configuration file syntax (Magnus Boden)laforge2003-09-281-51/+37
|
* add support for setting of SO_RCVBUF socket option to libipulog and ulogd ↵laforge2003-05-041-3/+6
| | | | (rmem config file entry)
* This patch fixes so the pathes in ulogd.conf matches what you gave tolaforge2003-04-271-0/+86
configure.. (Magnus Boden)