Ok, I have been trying to filter and keep the Skynet hourly reports into a separate log. At this point I am so close, a major accomplishment for me.
Question is can I use two filters to read one log and then have the results written to two different logs? This is crude and I have no doubt that someone who understands scripts could write this is one file and not two. Hey, baby steps into my seventh decade!
Here is the existing skynet filter that cmkelley includes in share/examples.
Code:
# this MUST BE the file configured in Skynet as the syslog.log location
# DO NOT use /tmp/syslog.log or /opt/var/log/messages here!
destination d_skynet {
file("/opt/var/log/skynet-0.log");
};
# logs everything from Skynet to /opt/var/log/skynet-0.log
filter f_skynet {
program("Skynet") or
message("BLOCKED -") or
message("[#]");
};
# final flag stops processing of messages matching the f_skynet filter
log {
source(src);
source(kernel);
filter(f_skynet);
destination(d_skynet);
flags(final);
};
#eof
Here is the one I want to use as the second to save hourly reports and write them to
skynet_h.log. I have highlighted with arrows the two areas I am not sure which will write the new skynet_h.log.
Code:
destination d_skynet-h {
file("/opt/var/log/skynet-0.log"); <<== this I know writes to the existing log (not what I want)
file("/opt/var/log/skynet_h.log"); <<== or this (NOT both! I know)
};
# logs everything from Skynet to /opt/var/log/skynet-h.log
filter f_skynet-h {
program("Skynet") or
message("[#]");
};
# final flag stops processing of messages matching the f_skynet filter
log {
source(src);
source(kernel);
filter(f_skynet-h);
destination(d_skynet-h.log); <<== will work and do it?
flags(final);
};
#eof
I tested it and it almost works using the "
file ("/opt/var/log/skynet-0.log");" , but I did not get the skynet_h.log I want, picked up old ones (some skipped, and some junk like startup and shutdown that is not wanted) not sure why but this is what I hope to save constant hourly reports.
Code:
Apr 11 04:58:40 RT-AC86U-4608 kernel: [BLOCKED - INVALID] IN=eth0 OUT= MAC=88:d7:f6:1d:46:08:00:01:5c:6d:22:46:08:00 SRC=195.231.8.114 DST=71.93.53.239 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=TCP SPT=41246 DPT=81 SEQ=1661009245 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
tail: /opt/var/log/skynet-0.log has been replaced; following end of new file
Apr 10 18:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 196 Inbound -- 0 Outbound Connections Blocked! [save] [3s]
Apr 10 19:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 286 Inbound -- 0 Outbound Connections Blocked! [save] [3s]
Apr 10 20:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 390 Inbound -- 0 Outbound Connections Blocked! [save] [3s]
Apr 10 21:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 505 Inbound -- 0 Outbound Connections Blocked! [save] [3s]
Apr 11 02:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 1048 Inbound -- 0 Outbound Connections Blocked! [save] [3s]
Apr 11 03:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 1173 Inbound -- 0 Outbound Connections Blocked! [save] [2s]
Apr 11 05:00:03 RT-AC86U-4608 Skynet: [#] 154538 IPs (+0) -- 1634 Ranges Banned (+0) || 1381 Inbound -- 0 Outbound Connections Blocked! [save] [3s]
Apr 11 05:01:03 RT-AC86U-4608 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=88:d7:f6:1d:46:08:00:01:5c:6d:22:46:08:00 SRC=207.244.86.222 DST=71.93.53.239 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=45265 PROTO=TCP SPT=55216 DPT=1933 SEQ=2240316083 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Apr 11 05:01:03 RT-AC86U-4608 kernel: [BLOCKED - INBOUND] IN=eth0 OUT= MAC=88:d7:f6:1d:46:08:00:01:5c:6d:22:46:08:00 SRC=185.176.27.98 DST=71.93.53.239 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=26379 PROTO=TCP SPT=43296 DPT=34498 SEQ=2723861542 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000 [/code/
