mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-09-29 19:24:29 +03:00
Redo build system to properly use autotools and avoid compilation with apxs util.
This commit is contained in:
b1v1r
76
mlogc/INSTALL
Normal file
76
mlogc/INSTALL
Normal file
@@ -0,0 +1,76 @@
|
||||
ModSecurity Audit Log Collector (mlogc)
|
||||
|
||||
Mlogc is used to connect a ModSecurity sensor to the central
|
||||
audit log repository.
|
||||
|
||||
To Install:
|
||||
===========
|
||||
|
||||
1) Copy the mlogc executable to an appropriate location.
|
||||
|
||||
A good location might be /usr/local/bin, /opt/mlogc/bin, etc.
|
||||
|
||||
2) Create sensor in the central audit log repository. Note the
|
||||
username and the password (SENSOR_USERNAME, SENSOR_PASSWORD).
|
||||
Also note the IP address central repository listens on
|
||||
(CONSOLE_IP_ADDRESS).
|
||||
|
||||
3) Configure the ModSecurity sensor to use mlogc
|
||||
|
||||
# Use ReleventOnly auditing
|
||||
SecAuditEngine RelevantOnly
|
||||
|
||||
# Must use concurrent logging
|
||||
SecAuditLogType Concurrent
|
||||
|
||||
# Send all audit log parts
|
||||
SecAuditLogParts ABIDEFGHZ
|
||||
|
||||
# Use the same /CollectorRoot/LogStorageDir as in mlogc.conf
|
||||
SecAuditLogStorageDir /var/log/mlogc/data
|
||||
|
||||
# Pipe audit log to mlogc with your configuration
|
||||
SecAuditLog "|/usr/local/bin/mlogc /etc/mlogc.conf"
|
||||
|
||||
4) Using the mlogc-default.conf as a template, configure the logger.
|
||||
|
||||
Typically these are the only directives that will need to be modified
|
||||
to conform to your site:
|
||||
|
||||
# Points to the root of the installation. All relative
|
||||
# paths configured in this file will be resolved with the
|
||||
# help of this path (LogStorageDir, TransactionLog, etc.)
|
||||
#
|
||||
# Typically, this will be the parent directory that is configured
|
||||
# in ModSecurity for the SecAuditLogStorageDirectory. So, if
|
||||
# your SecAuditLogStorageDirectory is set to /var/log/mlogc/data,
|
||||
# then set this to /var/log/mlogc.
|
||||
CollectorRoot "/var/log/mlogc"
|
||||
|
||||
# ModSecurity Console receiving URI. You can change the host
|
||||
# and the port parts but leave everything else as is.
|
||||
ConsoleURI https://CONSOLE_IP_ADDRESS:8886/rpc/auditLogReceiver
|
||||
|
||||
# Sensor credentials
|
||||
SensorUsername "SENSOR_USERNAME"
|
||||
SensorPassword "SENSOR_PASSWORD"
|
||||
|
||||
# Base directory where the audit logs are stored. This can be specified
|
||||
# as a path relative to the CollectorRoot, or a full path. It should
|
||||
# resolve to the same path as ModSecurity's SecAuditLogStorageDirectory.
|
||||
LogStorageDir "data"
|
||||
|
||||
See the mlogc-default.conf configuration file for details on other
|
||||
configuration directives.
|
||||
|
||||
5) Restart the ModSecurity sensor.
|
||||
|
||||
From now on every audit log generated will go to the repository. Make
|
||||
sure you create an alert. Transactions without alerts will be recorded
|
||||
but not displayed on the home page.
|
||||
|
||||
To troubleshoot, generate alerts and observe file "mlogc-error.log".
|
||||
|
||||
If mlogc fails to connect to the server it will pause for a period
|
||||
of time (60 seconds by default) before it will try again.
|
||||
|
||||
7
mlogc/Makefile.am
Normal file
7
mlogc/Makefile.am
Normal file
@@ -0,0 +1,7 @@
|
||||
bin_SCRIPTS = mlogc-batch-load.pl
|
||||
bin_PROGRAMS = mlogc
|
||||
mlogc_SOURCES = mlogc.c
|
||||
mlogc_CPPFLAGS = @APR_CPPFLAGS@ @PCRE_CPPFLAGS@ @CURL_CPPFLAGS@
|
||||
mlogc_CFLAGS = @APR_CFLAGS@ @PCRE_CFLAGS@ @CURL_CFLAGS@
|
||||
mlogc_LDFLAGS = @APR_LDFLAGS@ @PCRE_LDFLAGS@ @CURL_LDFLAGS@
|
||||
mlogc_LDADD = @APR_LDADD@ @PCRE_LDADD@ @CURL_LDADD@
|
||||
577
mlogc/Makefile.in
Normal file
577
mlogc/Makefile.in
Normal file
@@ -0,0 +1,577 @@
|
||||
# Makefile.in generated by automake 1.9.6 from Makefile.am.
|
||||
# @configure_input@
|
||||
|
||||
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
|
||||
# 2003, 2004, 2005 Free Software Foundation, Inc.
|
||||
# This Makefile.in is free software; the Free Software Foundation
|
||||
# gives unlimited permission to copy and/or distribute it,
|
||||
# with or without modifications, as long as this notice is preserved.
|
||||
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
|
||||
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
|
||||
# PARTICULAR PURPOSE.
|
||||
|
||||
@SET_MAKE@
|
||||
|
||||
|
||||
srcdir = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
VPATH = @srcdir@
|
||||
pkgdatadir = $(datadir)/@PACKAGE@
|
||||
pkglibdir = $(libdir)/@PACKAGE@
|
||||
pkgincludedir = $(includedir)/@PACKAGE@
|
||||
top_builddir = ..
|
||||
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
|
||||
INSTALL = @INSTALL@
|
||||
install_sh_DATA = $(install_sh) -c -m 644
|
||||
install_sh_PROGRAM = $(install_sh) -c
|
||||
install_sh_SCRIPT = $(install_sh) -c
|
||||
INSTALL_HEADER = $(INSTALL_DATA)
|
||||
transform = $(program_transform_name)
|
||||
NORMAL_INSTALL = :
|
||||
PRE_INSTALL = :
|
||||
POST_INSTALL = :
|
||||
NORMAL_UNINSTALL = :
|
||||
PRE_UNINSTALL = :
|
||||
POST_UNINSTALL = :
|
||||
build_triplet = @build@
|
||||
host_triplet = @host@
|
||||
bin_PROGRAMS = mlogc$(EXEEXT)
|
||||
subdir = mlogc
|
||||
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in \
|
||||
$(srcdir)/mlogc-batch-load.pl.in INSTALL
|
||||
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
|
||||
am__aclocal_m4_deps = $(top_srcdir)/acinclude/libtool.m4 \
|
||||
$(top_srcdir)/acinclude/ltoptions.m4 \
|
||||
$(top_srcdir)/acinclude/ltsugar.m4 \
|
||||
$(top_srcdir)/acinclude/ltversion.m4 \
|
||||
$(top_srcdir)/acinclude/lt~obsolete.m4 \
|
||||
$(top_srcdir)/build/find_pcre.m4 \
|
||||
$(top_srcdir)/build/find_apr.m4 \
|
||||
$(top_srcdir)/build/find_apu.m4 \
|
||||
$(top_srcdir)/build/find_xml.m4 \
|
||||
$(top_srcdir)/build/find_lua.m4 \
|
||||
$(top_srcdir)/build/find_curl.m4 $(top_srcdir)/configure.ac
|
||||
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
|
||||
$(ACLOCAL_M4)
|
||||
mkinstalldirs = $(install_sh) -d
|
||||
CONFIG_HEADER = $(top_builddir)/modsecurity_config.h
|
||||
CONFIG_CLEAN_FILES = mlogc-batch-load.pl
|
||||
am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(bindir)"
|
||||
binPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
|
||||
PROGRAMS = $(bin_PROGRAMS)
|
||||
am_mlogc_OBJECTS = mlogc-mlogc.$(OBJEXT)
|
||||
mlogc_OBJECTS = $(am_mlogc_OBJECTS)
|
||||
mlogc_DEPENDENCIES =
|
||||
binSCRIPT_INSTALL = $(INSTALL_SCRIPT)
|
||||
SCRIPTS = $(bin_SCRIPTS)
|
||||
DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir)
|
||||
depcomp = $(SHELL) $(top_srcdir)/build/depcomp
|
||||
am__depfiles_maybe = depfiles
|
||||
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
|
||||
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
|
||||
LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \
|
||||
$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
|
||||
$(AM_CFLAGS) $(CFLAGS)
|
||||
CCLD = $(CC)
|
||||
LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
|
||||
$(AM_LDFLAGS) $(LDFLAGS) -o $@
|
||||
SOURCES = $(mlogc_SOURCES)
|
||||
DIST_SOURCES = $(mlogc_SOURCES)
|
||||
ETAGS = etags
|
||||
CTAGS = ctags
|
||||
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
|
||||
ACLOCAL = @ACLOCAL@
|
||||
AMDEP_FALSE = @AMDEP_FALSE@
|
||||
AMDEP_TRUE = @AMDEP_TRUE@
|
||||
AMTAR = @AMTAR@
|
||||
APR_CFLAGS = @APR_CFLAGS@
|
||||
APR_CONFIG = @APR_CONFIG@
|
||||
APR_CPPFLAGS = @APR_CPPFLAGS@
|
||||
APR_LDADD = @APR_LDADD@
|
||||
APR_LDFLAGS = @APR_LDFLAGS@
|
||||
APR_VERSION = @APR_VERSION@
|
||||
APU_CFLAGS = @APU_CFLAGS@
|
||||
APU_CONFIG = @APU_CONFIG@
|
||||
APU_LDADD = @APU_LDADD@
|
||||
APU_LDFLAGS = @APU_LDFLAGS@
|
||||
APU_VERSION = @APU_VERSION@
|
||||
APXS = @APXS@
|
||||
APXS_BINDIR = @APXS_BINDIR@
|
||||
APXS_CC = @APXS_CC@
|
||||
APXS_CFLAGS = @APXS_CFLAGS@
|
||||
APXS_EXTRA_CFLAGS = @APXS_EXTRA_CFLAGS@
|
||||
APXS_HTTPD = @APXS_HTTPD@
|
||||
APXS_INCLUDEDIR = @APXS_INCLUDEDIR@
|
||||
APXS_INCLUDES = @APXS_INCLUDES@
|
||||
APXS_LDFLAGS = @APXS_LDFLAGS@
|
||||
APXS_LIBDIR = @APXS_LIBDIR@
|
||||
APXS_LIBEXECDIR = @APXS_LIBEXECDIR@
|
||||
APXS_LIBS = @APXS_LIBS@
|
||||
APXS_LIBTOOL = @APXS_LIBTOOL@
|
||||
APXS_MODULES = @APXS_MODULES@
|
||||
APXS_PROGNAME = @APXS_PROGNAME@
|
||||
APXS_SBINDIR = @APXS_SBINDIR@
|
||||
APXS_WRAPPER = @APXS_WRAPPER@
|
||||
AR = @AR@
|
||||
AUTOCONF = @AUTOCONF@
|
||||
AUTOHEADER = @AUTOHEADER@
|
||||
AUTOMAKE = @AUTOMAKE@
|
||||
AWK = @AWK@
|
||||
BUILD_APACHE2_MODULE_FALSE = @BUILD_APACHE2_MODULE_FALSE@
|
||||
BUILD_APACHE2_MODULE_TRUE = @BUILD_APACHE2_MODULE_TRUE@
|
||||
BUILD_DOCS_FALSE = @BUILD_DOCS_FALSE@
|
||||
BUILD_DOCS_TRUE = @BUILD_DOCS_TRUE@
|
||||
BUILD_MLOGC_FALSE = @BUILD_MLOGC_FALSE@
|
||||
BUILD_MLOGC_TRUE = @BUILD_MLOGC_TRUE@
|
||||
CC = @CC@
|
||||
CCDEPMODE = @CCDEPMODE@
|
||||
CFLAGS = @CFLAGS@
|
||||
CPP = @CPP@
|
||||
CPPFLAGS = @CPPFLAGS@
|
||||
CURL_CFLAGS = @CURL_CFLAGS@
|
||||
CURL_CONFIG = @CURL_CONFIG@
|
||||
CURL_CPPFLAGS = @CURL_CPPFLAGS@
|
||||
CURL_LDADD = @CURL_LDADD@
|
||||
CURL_LDFLAGS = @CURL_LDFLAGS@
|
||||
CURL_USES_GNUTLS = @CURL_USES_GNUTLS@
|
||||
CURL_VERSION = @CURL_VERSION@
|
||||
CYGPATH_W = @CYGPATH_W@
|
||||
DEFS = @DEFS@
|
||||
DEPDIR = @DEPDIR@
|
||||
DSYMUTIL = @DSYMUTIL@
|
||||
DUMPBIN = @DUMPBIN@
|
||||
ECHO_C = @ECHO_C@
|
||||
ECHO_N = @ECHO_N@
|
||||
ECHO_T = @ECHO_T@
|
||||
EGREP = @EGREP@
|
||||
ENV_CMD = @ENV_CMD@
|
||||
EXEEXT = @EXEEXT@
|
||||
EXTRA_CFLAGS = @EXTRA_CFLAGS@
|
||||
FGREP = @FGREP@
|
||||
GREP = @GREP@
|
||||
INSTALL_DATA = @INSTALL_DATA@
|
||||
INSTALL_PROGRAM = @INSTALL_PROGRAM@
|
||||
INSTALL_SCRIPT = @INSTALL_SCRIPT@
|
||||
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
|
||||
LD = @LD@
|
||||
LDFLAGS = @LDFLAGS@
|
||||
LIBOBJS = @LIBOBJS@
|
||||
LIBS = @LIBS@
|
||||
LIBTOOL = @LIBTOOL@
|
||||
LIBXML2_CFLAGS = @LIBXML2_CFLAGS@
|
||||
LIBXML2_CONFIG = @LIBXML2_CONFIG@
|
||||
LIBXML2_CPPFLAGS = @LIBXML2_CPPFLAGS@
|
||||
LIBXML2_LDADD = @LIBXML2_LDADD@
|
||||
LIBXML2_LDFLAGS = @LIBXML2_LDFLAGS@
|
||||
LIBXML2_VERSION = @LIBXML2_VERSION@
|
||||
LIPO = @LIPO@
|
||||
LN_S = @LN_S@
|
||||
LTLIBOBJS = @LTLIBOBJS@
|
||||
LUA_CFLAGS = @LUA_CFLAGS@
|
||||
LUA_CPPFLAGS = @LUA_CPPFLAGS@
|
||||
LUA_LDADD = @LUA_LDADD@
|
||||
LUA_LDFLAGS = @LUA_LDFLAGS@
|
||||
MAKEINFO = @MAKEINFO@
|
||||
MODSEC_APXS_EXTRA_CFLAGS = @MODSEC_APXS_EXTRA_CFLAGS@
|
||||
MODSEC_EXTRA_CFLAGS = @MODSEC_EXTRA_CFLAGS@
|
||||
MSC_BASE_DIR = @MSC_BASE_DIR@
|
||||
MSC_PKGBASE_DIR = @MSC_PKGBASE_DIR@
|
||||
MSC_REGRESSION_CONF_DIR = @MSC_REGRESSION_CONF_DIR@
|
||||
MSC_REGRESSION_DIR = @MSC_REGRESSION_DIR@
|
||||
MSC_REGRESSION_DOCROOT_DIR = @MSC_REGRESSION_DOCROOT_DIR@
|
||||
MSC_REGRESSION_LOGS_DIR = @MSC_REGRESSION_LOGS_DIR@
|
||||
MSC_REGRESSION_SERVERROOT_DIR = @MSC_REGRESSION_SERVERROOT_DIR@
|
||||
MSC_TEST_DIR = @MSC_TEST_DIR@
|
||||
NM = @NM@
|
||||
NMEDIT = @NMEDIT@
|
||||
OBJDUMP = @OBJDUMP@
|
||||
OBJEXT = @OBJEXT@
|
||||
OTOOL = @OTOOL@
|
||||
OTOOL64 = @OTOOL64@
|
||||
PACKAGE = @PACKAGE@
|
||||
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
|
||||
PACKAGE_NAME = @PACKAGE_NAME@
|
||||
PACKAGE_STRING = @PACKAGE_STRING@
|
||||
PACKAGE_TARNAME = @PACKAGE_TARNAME@
|
||||
PACKAGE_URL = @PACKAGE_URL@
|
||||
PACKAGE_VERSION = @PACKAGE_VERSION@
|
||||
PATH_SEPARATOR = @PATH_SEPARATOR@
|
||||
PCRE_CFLAGS = @PCRE_CFLAGS@
|
||||
PCRE_CONFIG = @PCRE_CONFIG@
|
||||
PCRE_CPPFLAGS = @PCRE_CPPFLAGS@
|
||||
PCRE_LDADD = @PCRE_LDADD@
|
||||
PCRE_LDFLAGS = @PCRE_LDFLAGS@
|
||||
PCRE_VERSION = @PCRE_VERSION@
|
||||
PERL = @PERL@
|
||||
RANLIB = @RANLIB@
|
||||
SED = @SED@
|
||||
SET_MAKE = @SET_MAKE@
|
||||
SHELL = @SHELL@
|
||||
STRIP = @STRIP@
|
||||
TOPLEVEL_SUBDIRS = @TOPLEVEL_SUBDIRS@
|
||||
VERSION = @VERSION@
|
||||
ac_ct_CC = @ac_ct_CC@
|
||||
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
|
||||
am__fastdepCC_FALSE = @am__fastdepCC_FALSE@
|
||||
am__fastdepCC_TRUE = @am__fastdepCC_TRUE@
|
||||
am__include = @am__include@
|
||||
am__leading_dot = @am__leading_dot@
|
||||
am__quote = @am__quote@
|
||||
am__tar = @am__tar@
|
||||
am__untar = @am__untar@
|
||||
bindir = @bindir@
|
||||
build = @build@
|
||||
build_alias = @build_alias@
|
||||
build_cpu = @build_cpu@
|
||||
build_os = @build_os@
|
||||
build_vendor = @build_vendor@
|
||||
datadir = @datadir@
|
||||
datarootdir = @datarootdir@
|
||||
docdir = @docdir@
|
||||
dvidir = @dvidir@
|
||||
exec_prefix = @exec_prefix@
|
||||
host = @host@
|
||||
host_alias = @host_alias@
|
||||
host_cpu = @host_cpu@
|
||||
host_os = @host_os@
|
||||
host_vendor = @host_vendor@
|
||||
htmldir = @htmldir@
|
||||
includedir = @includedir@
|
||||
infodir = @infodir@
|
||||
install_sh = @install_sh@
|
||||
libdir = @libdir@
|
||||
libexecdir = @libexecdir@
|
||||
localedir = @localedir@
|
||||
localstatedir = @localstatedir@
|
||||
lt_ECHO = @lt_ECHO@
|
||||
mandir = @mandir@
|
||||
mkdir_p = @mkdir_p@
|
||||
oldincludedir = @oldincludedir@
|
||||
pdfdir = @pdfdir@
|
||||
prefix = @prefix@
|
||||
program_transform_name = @program_transform_name@
|
||||
psdir = @psdir@
|
||||
sbindir = @sbindir@
|
||||
sharedstatedir = @sharedstatedir@
|
||||
sysconfdir = @sysconfdir@
|
||||
target_alias = @target_alias@
|
||||
bin_SCRIPTS = mlogc-batch-load.pl
|
||||
mlogc_SOURCES = mlogc.c
|
||||
mlogc_CPPFLAGS = @APR_CPPFLAGS@ @PCRE_CPPFLAGS@ @CURL_CPPFLAGS@
|
||||
mlogc_CFLAGS = @APR_CFLAGS@ @PCRE_CFLAGS@ @CURL_CFLAGS@
|
||||
mlogc_LDFLAGS = @APR_LDFLAGS@ @PCRE_LDFLAGS@ @CURL_LDFLAGS@
|
||||
mlogc_LDADD = @APR_LDADD@ @PCRE_LDADD@ @CURL_LDADD@
|
||||
all: all-am
|
||||
|
||||
.SUFFIXES:
|
||||
.SUFFIXES: .c .lo .o .obj
|
||||
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
|
||||
@for dep in $?; do \
|
||||
case '$(am__configure_deps)' in \
|
||||
*$$dep*) \
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
|
||||
&& exit 0; \
|
||||
exit 1;; \
|
||||
esac; \
|
||||
done; \
|
||||
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign mlogc/Makefile'; \
|
||||
cd $(top_srcdir) && \
|
||||
$(AUTOMAKE) --foreign mlogc/Makefile
|
||||
.PRECIOUS: Makefile
|
||||
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
|
||||
@case '$?' in \
|
||||
*config.status*) \
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
|
||||
*) \
|
||||
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
|
||||
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
|
||||
esac;
|
||||
|
||||
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
|
||||
$(top_srcdir)/configure: $(am__configure_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
mlogc-batch-load.pl: $(top_builddir)/config.status $(srcdir)/mlogc-batch-load.pl.in
|
||||
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@
|
||||
install-binPROGRAMS: $(bin_PROGRAMS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(bindir)" || $(mkdir_p) "$(DESTDIR)$(bindir)"
|
||||
@list='$(bin_PROGRAMS)'; for p in $$list; do \
|
||||
p1=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
|
||||
if test -f $$p \
|
||||
|| test -f $$p1 \
|
||||
; then \
|
||||
f=`echo "$$p1" | sed 's,^.*/,,;$(transform);s/$$/$(EXEEXT)/'`; \
|
||||
echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) --mode=install $(binPROGRAMS_INSTALL) '$$p' '$(DESTDIR)$(bindir)/$$f'"; \
|
||||
$(INSTALL_PROGRAM_ENV) $(LIBTOOL) --mode=install $(binPROGRAMS_INSTALL) "$$p" "$(DESTDIR)$(bindir)/$$f" || exit 1; \
|
||||
else :; fi; \
|
||||
done
|
||||
|
||||
uninstall-binPROGRAMS:
|
||||
@$(NORMAL_UNINSTALL)
|
||||
@list='$(bin_PROGRAMS)'; for p in $$list; do \
|
||||
f=`echo "$$p" | sed 's,^.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
|
||||
echo " rm -f '$(DESTDIR)$(bindir)/$$f'"; \
|
||||
rm -f "$(DESTDIR)$(bindir)/$$f"; \
|
||||
done
|
||||
|
||||
clean-binPROGRAMS:
|
||||
@list='$(bin_PROGRAMS)'; for p in $$list; do \
|
||||
f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
|
||||
echo " rm -f $$p $$f"; \
|
||||
rm -f $$p $$f ; \
|
||||
done
|
||||
mlogc$(EXEEXT): $(mlogc_OBJECTS) $(mlogc_DEPENDENCIES)
|
||||
@rm -f mlogc$(EXEEXT)
|
||||
$(LINK) $(mlogc_LDFLAGS) $(mlogc_OBJECTS) $(mlogc_LDADD) $(LIBS)
|
||||
install-binSCRIPTS: $(bin_SCRIPTS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(bindir)" || $(mkdir_p) "$(DESTDIR)$(bindir)"
|
||||
@list='$(bin_SCRIPTS)'; for p in $$list; do \
|
||||
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
if test -f $$d$$p; then \
|
||||
f=`echo "$$p" | sed 's|^.*/||;$(transform)'`; \
|
||||
echo " $(binSCRIPT_INSTALL) '$$d$$p' '$(DESTDIR)$(bindir)/$$f'"; \
|
||||
$(binSCRIPT_INSTALL) "$$d$$p" "$(DESTDIR)$(bindir)/$$f"; \
|
||||
else :; fi; \
|
||||
done
|
||||
|
||||
uninstall-binSCRIPTS:
|
||||
@$(NORMAL_UNINSTALL)
|
||||
@list='$(bin_SCRIPTS)'; for p in $$list; do \
|
||||
f=`echo "$$p" | sed 's|^.*/||;$(transform)'`; \
|
||||
echo " rm -f '$(DESTDIR)$(bindir)/$$f'"; \
|
||||
rm -f "$(DESTDIR)$(bindir)/$$f"; \
|
||||
done
|
||||
|
||||
mostlyclean-compile:
|
||||
-rm -f *.$(OBJEXT)
|
||||
|
||||
distclean-compile:
|
||||
-rm -f *.tab.c
|
||||
|
||||
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/mlogc-mlogc.Po@am__quote@
|
||||
|
||||
.c.o:
|
||||
@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
|
||||
@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
|
||||
|
||||
.c.obj:
|
||||
@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ `$(CYGPATH_W) '$<'`; \
|
||||
@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
|
||||
|
||||
.c.lo:
|
||||
@am__fastdepCC_TRUE@ if $(LTCOMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
|
||||
@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Plo"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
|
||||
|
||||
mlogc-mlogc.o: mlogc.c
|
||||
@am__fastdepCC_TRUE@ if $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(mlogc_CPPFLAGS) $(CPPFLAGS) $(mlogc_CFLAGS) $(CFLAGS) -MT mlogc-mlogc.o -MD -MP -MF "$(DEPDIR)/mlogc-mlogc.Tpo" -c -o mlogc-mlogc.o `test -f 'mlogc.c' || echo '$(srcdir)/'`mlogc.c; \
|
||||
@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/mlogc-mlogc.Tpo" "$(DEPDIR)/mlogc-mlogc.Po"; else rm -f "$(DEPDIR)/mlogc-mlogc.Tpo"; exit 1; fi
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='mlogc.c' object='mlogc-mlogc.o' libtool=no @AMDEPBACKSLASH@
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(mlogc_CPPFLAGS) $(CPPFLAGS) $(mlogc_CFLAGS) $(CFLAGS) -c -o mlogc-mlogc.o `test -f 'mlogc.c' || echo '$(srcdir)/'`mlogc.c
|
||||
|
||||
mlogc-mlogc.obj: mlogc.c
|
||||
@am__fastdepCC_TRUE@ if $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(mlogc_CPPFLAGS) $(CPPFLAGS) $(mlogc_CFLAGS) $(CFLAGS) -MT mlogc-mlogc.obj -MD -MP -MF "$(DEPDIR)/mlogc-mlogc.Tpo" -c -o mlogc-mlogc.obj `if test -f 'mlogc.c'; then $(CYGPATH_W) 'mlogc.c'; else $(CYGPATH_W) '$(srcdir)/mlogc.c'; fi`; \
|
||||
@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/mlogc-mlogc.Tpo" "$(DEPDIR)/mlogc-mlogc.Po"; else rm -f "$(DEPDIR)/mlogc-mlogc.Tpo"; exit 1; fi
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='mlogc.c' object='mlogc-mlogc.obj' libtool=no @AMDEPBACKSLASH@
|
||||
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
|
||||
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(mlogc_CPPFLAGS) $(CPPFLAGS) $(mlogc_CFLAGS) $(CFLAGS) -c -o mlogc-mlogc.obj `if test -f 'mlogc.c'; then $(CYGPATH_W) 'mlogc.c'; else $(CYGPATH_W) '$(srcdir)/mlogc.c'; fi`
|
||||
|
||||
mostlyclean-libtool:
|
||||
-rm -f *.lo
|
||||
|
||||
clean-libtool:
|
||||
-rm -rf .libs _libs
|
||||
|
||||
distclean-libtool:
|
||||
-rm -f libtool
|
||||
uninstall-info-am:
|
||||
|
||||
ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
|
||||
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
|
||||
unique=`for i in $$list; do \
|
||||
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
|
||||
done | \
|
||||
$(AWK) ' { files[$$0] = 1; } \
|
||||
END { for (i in files) print i; }'`; \
|
||||
mkid -fID $$unique
|
||||
tags: TAGS
|
||||
|
||||
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
|
||||
$(TAGS_FILES) $(LISP)
|
||||
tags=; \
|
||||
here=`pwd`; \
|
||||
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
|
||||
unique=`for i in $$list; do \
|
||||
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
|
||||
done | \
|
||||
$(AWK) ' { files[$$0] = 1; } \
|
||||
END { for (i in files) print i; }'`; \
|
||||
if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
|
||||
test -n "$$unique" || unique=$$empty_fix; \
|
||||
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
|
||||
$$tags $$unique; \
|
||||
fi
|
||||
ctags: CTAGS
|
||||
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
|
||||
$(TAGS_FILES) $(LISP)
|
||||
tags=; \
|
||||
here=`pwd`; \
|
||||
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
|
||||
unique=`for i in $$list; do \
|
||||
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
|
||||
done | \
|
||||
$(AWK) ' { files[$$0] = 1; } \
|
||||
END { for (i in files) print i; }'`; \
|
||||
test -z "$(CTAGS_ARGS)$$tags$$unique" \
|
||||
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
|
||||
$$tags $$unique
|
||||
|
||||
GTAGS:
|
||||
here=`$(am__cd) $(top_builddir) && pwd` \
|
||||
&& cd $(top_srcdir) \
|
||||
&& gtags -i $(GTAGS_ARGS) $$here
|
||||
|
||||
distclean-tags:
|
||||
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
|
||||
|
||||
distdir: $(DISTFILES)
|
||||
@srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \
|
||||
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \
|
||||
list='$(DISTFILES)'; for file in $$list; do \
|
||||
case $$file in \
|
||||
$(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \
|
||||
$(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \
|
||||
esac; \
|
||||
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
|
||||
dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \
|
||||
if test "$$dir" != "$$file" && test "$$dir" != "."; then \
|
||||
dir="/$$dir"; \
|
||||
$(mkdir_p) "$(distdir)$$dir"; \
|
||||
else \
|
||||
dir=''; \
|
||||
fi; \
|
||||
if test -d $$d/$$file; then \
|
||||
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
|
||||
cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
|
||||
fi; \
|
||||
cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
|
||||
else \
|
||||
test -f $(distdir)/$$file \
|
||||
|| cp -p $$d/$$file $(distdir)/$$file \
|
||||
|| exit 1; \
|
||||
fi; \
|
||||
done
|
||||
check-am: all-am
|
||||
check: check-am
|
||||
all-am: Makefile $(PROGRAMS) $(SCRIPTS)
|
||||
installdirs:
|
||||
for dir in "$(DESTDIR)$(bindir)" "$(DESTDIR)$(bindir)"; do \
|
||||
test -z "$$dir" || $(mkdir_p) "$$dir"; \
|
||||
done
|
||||
install: install-am
|
||||
install-exec: install-exec-am
|
||||
install-data: install-data-am
|
||||
uninstall: uninstall-am
|
||||
|
||||
install-am: all-am
|
||||
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
|
||||
|
||||
installcheck: installcheck-am
|
||||
install-strip:
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
`test -z '$(STRIP)' || \
|
||||
echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
|
||||
mostlyclean-generic:
|
||||
|
||||
clean-generic:
|
||||
|
||||
distclean-generic:
|
||||
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
|
||||
|
||||
maintainer-clean-generic:
|
||||
@echo "This command is intended for maintainers to use"
|
||||
@echo "it deletes files that may require special tools to rebuild."
|
||||
clean: clean-am
|
||||
|
||||
clean-am: clean-binPROGRAMS clean-generic clean-libtool mostlyclean-am
|
||||
|
||||
distclean: distclean-am
|
||||
-rm -rf ./$(DEPDIR)
|
||||
-rm -f Makefile
|
||||
distclean-am: clean-am distclean-compile distclean-generic \
|
||||
distclean-libtool distclean-tags
|
||||
|
||||
dvi: dvi-am
|
||||
|
||||
dvi-am:
|
||||
|
||||
html: html-am
|
||||
|
||||
info: info-am
|
||||
|
||||
info-am:
|
||||
|
||||
install-data-am:
|
||||
|
||||
install-exec-am: install-binPROGRAMS install-binSCRIPTS
|
||||
|
||||
install-info: install-info-am
|
||||
|
||||
install-man:
|
||||
|
||||
installcheck-am:
|
||||
|
||||
maintainer-clean: maintainer-clean-am
|
||||
-rm -rf ./$(DEPDIR)
|
||||
-rm -f Makefile
|
||||
maintainer-clean-am: distclean-am maintainer-clean-generic
|
||||
|
||||
mostlyclean: mostlyclean-am
|
||||
|
||||
mostlyclean-am: mostlyclean-compile mostlyclean-generic \
|
||||
mostlyclean-libtool
|
||||
|
||||
pdf: pdf-am
|
||||
|
||||
pdf-am:
|
||||
|
||||
ps: ps-am
|
||||
|
||||
ps-am:
|
||||
|
||||
uninstall-am: uninstall-binPROGRAMS uninstall-binSCRIPTS \
|
||||
uninstall-info-am
|
||||
|
||||
.PHONY: CTAGS GTAGS all all-am check check-am clean clean-binPROGRAMS \
|
||||
clean-generic clean-libtool ctags distclean distclean-compile \
|
||||
distclean-generic distclean-libtool distclean-tags distdir dvi \
|
||||
dvi-am html html-am info info-am install install-am \
|
||||
install-binPROGRAMS install-binSCRIPTS install-data \
|
||||
install-data-am install-exec install-exec-am install-info \
|
||||
install-info-am install-man install-strip installcheck \
|
||||
installcheck-am installdirs maintainer-clean \
|
||||
maintainer-clean-generic mostlyclean mostlyclean-compile \
|
||||
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
|
||||
tags uninstall uninstall-am uninstall-binPROGRAMS \
|
||||
uninstall-binSCRIPTS uninstall-info-am
|
||||
|
||||
# Tell versions [3.59,3.63) of GNU make to not export all variables.
|
||||
# Otherwise a system limit (for SysV at least) may be exceeded.
|
||||
.NOEXPORT:
|
||||
57
mlogc/Makefile.win
Executable file
57
mlogc/Makefile.win
Executable file
@@ -0,0 +1,57 @@
|
||||
###########################################################################
|
||||
### You Will need to modify the following variables for your system
|
||||
###########################################################################
|
||||
###########################################################################
|
||||
|
||||
# Path to Apache httpd installation
|
||||
BASE = C:\Apache2
|
||||
|
||||
# Paths to required libraries
|
||||
PCRE = C:\work\pcre-7.0-lib
|
||||
CURL = C:\work\libcurl-7.19.3-win32-ssl-msvc
|
||||
|
||||
# Linking libraries
|
||||
LIBS = $(BASE)\lib\libapr-1.lib \
|
||||
$(BASE)\lib\libaprutil-1.lib \
|
||||
$(PCRE)\lib\pcre.lib \
|
||||
$(CURL)\lib\Release\curllib.lib \
|
||||
wsock32.lib
|
||||
|
||||
###########################################################################
|
||||
###########################################################################
|
||||
|
||||
CC = cL
|
||||
|
||||
MT = mt
|
||||
|
||||
DEFS = /nologo /O2 /W3 -DWIN32 -DWINNT -Dinline=APR_INLINE -D_CONSOLE
|
||||
|
||||
EXE = mlogc.exe
|
||||
|
||||
INCLUDES = -I. -I.. \
|
||||
-I$(PCRE)\include -I$(PCRE) \
|
||||
-I$(CURL)\include -I$(CURL) \
|
||||
-I$(BASE)\include
|
||||
|
||||
CFLAGS= -MT $(INCLUDES) $(DEFS)
|
||||
|
||||
LDFLAGS =
|
||||
|
||||
OBJS = mlogc.obj
|
||||
|
||||
all: $(EXE)
|
||||
|
||||
.c.obj:
|
||||
$(CC) $(CFLAGS) -c $< -Fo$@
|
||||
|
||||
.cpp.obj:
|
||||
$(CC) $(CFLAGS) -c $< -Fo$@
|
||||
|
||||
$(EXE): $(OBJS)
|
||||
$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS) $(LIBS) /link /NODEFAULTLIB:MSVCRT.lib /subsystem:console
|
||||
|
||||
install: $(EXE)
|
||||
copy $(EXE) $(BASE)\bin
|
||||
|
||||
clean:
|
||||
del $(OBJS) $(EXE) *.dll *.lib *.pdb *.idb *.ilk *.exp *.res *.rc *.bin *.manifest
|
||||
151
mlogc/mlogc-batch-load.pl.in
Executable file
151
mlogc/mlogc-batch-load.pl.in
Executable file
@@ -0,0 +1,151 @@
|
||||
#!@PERL@
|
||||
#
|
||||
# ModSecurity for Apache 2.x, http://www.modsecurity.org/
|
||||
# Copyright (c) 2004-2009 Breach Security, Inc. (http://www.breach.com/)
|
||||
#
|
||||
# This product is released under the terms of the General Public Licence,
|
||||
# version 2 (GPLv2). Please refer to the file LICENSE (included with this
|
||||
# distribution) which contains the complete text of the licence.
|
||||
#
|
||||
# There are special exceptions to the terms and conditions of the GPL
|
||||
# as it is applied to this software. View the full text of the exception in
|
||||
# file MODSECURITY_LICENSING_EXCEPTION in the directory of this software
|
||||
# distribution.
|
||||
#
|
||||
# If any of the files related to licensing are missing or if you have any
|
||||
# other questions related to licensing please contact Breach Security, Inc.
|
||||
# directly using the email address support@breach.com.
|
||||
#
|
||||
|
||||
use strict;
|
||||
use File::Find qw(find);
|
||||
use File::Spec::Functions qw(catfile);
|
||||
use Sys::Hostname qw(hostname);
|
||||
use Digest::MD5 qw(md5_hex);
|
||||
|
||||
my $ROOTDIR = $ARGV[0] || '';
|
||||
my $MLOGC = $ARGV[1] || '';
|
||||
my $MLOGCCONF = $ARGV[2] || '';
|
||||
my @AUDIT = ();
|
||||
|
||||
if ($ROOTDIR eq '' or ! -e $MLOGC or ! -e $MLOGCCONF) {
|
||||
printf STDERR "\nUsage: $0 <rootdir> </path/to/mlogc> <mlogc_config>\n\n";
|
||||
exit 1;
|
||||
}
|
||||
|
||||
open(MLOGC, "|$MLOGC -f $MLOGCCONF") or die "ERROR: could not open '$MLOGC' - $!\n";
|
||||
|
||||
find(
|
||||
{
|
||||
wanted => sub {
|
||||
my($fn,$dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size);
|
||||
|
||||
(($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size) = stat($_)) &&
|
||||
-f _ &&
|
||||
/^\d{8}-\d+-\w{24}$/s
|
||||
&& (($fn = $File::Find::name) =~ s/^\Q$ROOTDIR\E//)
|
||||
&& push(@AUDIT, [$fn, $size]);
|
||||
},
|
||||
follow => 1,
|
||||
},
|
||||
$ROOTDIR
|
||||
);
|
||||
|
||||
for my $audit (@AUDIT) {
|
||||
my $fn = $audit->[0];
|
||||
my $line = "";
|
||||
my $err = 0;
|
||||
my $ln = 0;
|
||||
my $sln = 0;
|
||||
my $sect = "";
|
||||
my $data = "";
|
||||
my %data = (
|
||||
hostname => hostname(),
|
||||
remote_addr => "-",
|
||||
remote_user => "-",
|
||||
local_user => "-",
|
||||
logtime => "-",
|
||||
request => "-",
|
||||
response_status => "-",
|
||||
bytes_sent => "-",
|
||||
referer => "-",
|
||||
user_agent => "-",
|
||||
uniqueid => "-",
|
||||
sessionid => "-",
|
||||
audit_file => $fn,
|
||||
extra => "0",
|
||||
audit_size => $audit->[1],
|
||||
md5 => "-",
|
||||
);
|
||||
|
||||
### Parse the audit file in an attempt to recreate the original log line
|
||||
open (AUDIT, "<".catfile($ROOTDIR,$fn)) or $err = 1;
|
||||
if ($err == 1) {
|
||||
print STDERR "ERROR: could not open '$fn' - $!\n";
|
||||
next;
|
||||
}
|
||||
|
||||
while($line = <AUDIT>) {
|
||||
$data .= $line;
|
||||
chop $line;
|
||||
$ln++;
|
||||
$sln++;
|
||||
if ($line =~ m%^--[0-9A-Fa-f]{8}-([A-Z])--$%) {
|
||||
$sect = $1;
|
||||
$sln = 0;
|
||||
next;
|
||||
};
|
||||
if ($sect eq 'A') {
|
||||
if ($line =~ m%^(\[[-\d/: a-zA-Z]{27}\]) (\S+) (\S+) (\d+) (\S+) (\d+)%) {
|
||||
$data{logtime} = $1;
|
||||
$data{uniqueid} = $2;
|
||||
$data{remote_addr} = $3;
|
||||
}
|
||||
next;
|
||||
}
|
||||
elsif ($sect eq 'B') {
|
||||
if ($sln == 1) {
|
||||
$data{request} = $line;
|
||||
}
|
||||
elsif ($line =~ m%^User=Agent: (.*)%i) {
|
||||
$data{user_agent} = $1;
|
||||
}
|
||||
elsif ($line =~ m%^Referer: (.*)%i) {
|
||||
$data{referer} = $1;
|
||||
}
|
||||
next;
|
||||
}
|
||||
elsif ($sect eq 'F') {
|
||||
if ($sln == 1 and $line =~ m%^\S+ (\d{3})\D?.*%) {
|
||||
$data{response_status} = $1;
|
||||
}
|
||||
elsif ($line =~ m%^Content-Length: (\d+)%i) {
|
||||
$data{bytes_sent} = $1;
|
||||
}
|
||||
next;
|
||||
}
|
||||
}
|
||||
$data{md5} = md5_hex($data);
|
||||
|
||||
printf MLOGC (
|
||||
"%s %s %s %s %s \"%s\" %s %s \"%s\" \"%s\" %s \"%s\" %s %s %s md5:%s\n",
|
||||
$data{hostname},
|
||||
$data{remote_addr},
|
||||
$data{remote_user},
|
||||
$data{local_user},
|
||||
$data{logtime},
|
||||
$data{request},
|
||||
$data{response_status},
|
||||
$data{bytes_sent},
|
||||
$data{referer},
|
||||
$data{user_agent},
|
||||
$data{uniqueid},
|
||||
$data{sessionid},
|
||||
$data{audit_file},
|
||||
$data{extra},
|
||||
$data{audit_size},
|
||||
$data{md5},
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
98
mlogc/mlogc-default.conf
Normal file
98
mlogc/mlogc-default.conf
Normal file
@@ -0,0 +1,98 @@
|
||||
##########################################################################
|
||||
# Required configuration
|
||||
# At a minimum, the items in this section will need to be adjusted to
|
||||
# fit your environment. The remaining options are optional.
|
||||
##########################################################################
|
||||
|
||||
# Points to the root of the installation. All relative
|
||||
# paths will be resolved with the help of this path.
|
||||
CollectorRoot "/var/log/mlogc"
|
||||
|
||||
# ModSecurity Console receiving URI. You can change the host
|
||||
# and the port parts but leave everything else as is.
|
||||
ConsoleURI "https://CONSOLE_IP_ADDRESS:8888/rpc/auditLogReceiver"
|
||||
|
||||
# Sensor credentials
|
||||
SensorUsername "SENSOR_USERNAME"
|
||||
SensorPassword "SENSOR_PASSWORD"
|
||||
|
||||
# Base directory where the audit logs are stored. This can be specified
|
||||
# as a path relative to the CollectorRoot, or a full path.
|
||||
LogStorageDir "data"
|
||||
|
||||
# Transaction log will contain the information on all log collector
|
||||
# activities that happen between checkpoints. The transaction log
|
||||
# is used to recover data in case of a crash (or if Apache kills
|
||||
# the process).
|
||||
TransactionLog "mlogc-transaction.log"
|
||||
|
||||
# The file where the pending audit log entry data is kept. This file
|
||||
# is updated on every checkpoint.
|
||||
QueuePath "mlogc-queue.log"
|
||||
|
||||
# The location of the error log.
|
||||
ErrorLog "mlogc-error.log"
|
||||
|
||||
# The location of the lock file.
|
||||
LockFile "mlogc.lck"
|
||||
|
||||
# Keep audit log entries after sending? (0=false 1=true)
|
||||
# NOTE: This is required to be set in SecAuditLog mlogc config if you
|
||||
# are going to use a secondary console via SecAuditLog2.
|
||||
KeepEntries 0
|
||||
|
||||
|
||||
##########################################################################
|
||||
# Optional configuration
|
||||
##########################################################################
|
||||
|
||||
# The error log level controls how much detail there
|
||||
# will be in the error log. The levels are as follows:
|
||||
# 0 - NONE
|
||||
# 1 - ERROR
|
||||
# 2 - WARNING
|
||||
# 3 - NOTICE
|
||||
# 4 - DEBUG
|
||||
# 5 - DEBUG2
|
||||
#
|
||||
ErrorLogLevel 3
|
||||
|
||||
# How many concurrent connections to the server
|
||||
# are we allowed to open at the same time? Log collector uses
|
||||
# multiple connections in order to speed up audit log transfer.
|
||||
# This is especially needed when the communication takes place
|
||||
# over a slow link (e.g. not over a LAN).
|
||||
MaxConnections 10
|
||||
|
||||
# How many requests a worker will process before recycling itself.
|
||||
# This is to help prevent problems due to any memory leaks that may
|
||||
# exists. If this is set to 0, then no maximum is imposed. The default
|
||||
# is 1000 requests per worker (the number of workers is controlled by the
|
||||
# MaxConnections limit).
|
||||
MaxWorkerRequests 1000
|
||||
|
||||
# The time each connection will sit idle before being reused,
|
||||
# in milliseconds. Increase if you don't want ModSecurity Console
|
||||
# to be hit with too many log collector requests.
|
||||
TransactionDelay 50
|
||||
|
||||
# The time to wait before initialization on startup in milliseconds.
|
||||
# Increase if mlogc is starting faster then termination when the
|
||||
# sensor is reloaded.
|
||||
StartupDelay 5000
|
||||
|
||||
# How often is the pending audit log entry data going to be written
|
||||
# to a file. The default is 15 seconds.
|
||||
CheckpointInterval 15
|
||||
|
||||
# If the server fails all threads will back down until the
|
||||
# problem is sorted. The management thread will periodically
|
||||
# launch a thread to test the server. The default is to test
|
||||
# once in 60 seconds.
|
||||
ServerErrorTimeout 60
|
||||
|
||||
# The following two parameters are not used yet, but
|
||||
# reserved for future expansion.
|
||||
# KeepAlive 150
|
||||
# KeepAliveTimeout 300
|
||||
|
||||
2311
mlogc/mlogc.c
Normal file
2311
mlogc/mlogc.c
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user