Syslog Server for localhost and Cisco.

A bit ago I posted about Linux audit logs. This is kind of a follow up to that. It is a much nicer way to view and search them.

So I set up a syslog server, but I decided to make it much nicer to myself and add a program called loganalyzer to it (it uses apache and php to view the logs and makes it look so much nicer).

I was going to put this in a CentOS box I had installed but I forgot the password, so I was going to fresh install everything anyway but the most recent Virtual Box update broke PXE booting.. So I installed everything on my Fedora 20 test box.

I followed the basic instructions (with a few modifications) from
http://tecadmin.net/setup-rsyslog-with-mysql-and-loganalyzer/
and
http://tecadmin.net/setup-loganalyzer-with-rsyslog-and-mysql/ but I will post them as well as I had trouble with step 3.6 to 3.7 so I started over from step 3.1 and got it to work. Basically it kept looping me weird.back to step 6.

The basics are:
Install the packages:
# yum install php php-mysql mysql-server httpd
Start the services:
# service httpd start
# service mysqld start
Make sure they are on at startup:
# chkconfig httpd on
# chkconfig mysqld on <-wouldn't run for me
# mysqladmin -u root password 'itsasecret'
Install more packages:
# yum install rsyslog rsyslog-mysql
Turn off syslog:
# service syslog stop
# chkconfig syslog off
Turn on rsyslog:
# service rsyslog start
# chkconfig rsyslog on
Create rsyslog Database:
# mysql -u root -p < /usr/share/doc/rsyslog-mysql-4.8.10/createDB.sql
Create MySQL user and grant privileges
# mysql -u root -p
mysql> GRANT ALL ON Syslog.* TO 'user'@'localhost' IDENTIFIED BY 'itsadifferentsecret';
mysql> FLUSH PRIVILEGES;
mysql> exit
# vi /etc/rsyslog.conf <-note you can use whatever editor you want here.
In the Modules section of the file (this is near the begining) add:
$ModLoad ommysql
 *.* :ommysql:127.0.0.1,Syslog,user,itsadifferentsecret
Restart the service
# service rsyslog restart

Then install loganaylzer:
# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz
# tar xzf loganalyzer-3.6.5.tar.gz
Move it to where httpd can get to:
# mv loganalyzer-3.6.5/src /var/www/html/loganalyzer
Create a blank config file and give apache the rights to it:
# cd /var/www/html/loganalyzer
# touch config.php
# chown apache:apache config.php
# chmod 777 config.php

Here I had some selinux issues. I ran: "setenforce 0" and was able to find out the problem.

Run: setsebool -P http_read_user_content 1

If you changed setenforce change it back to 1

In a web browser go to:

http:ip.of.log.server/loganalyzer/install.php

(I did this on the local machine)

Here is where I recommend using the other guys pictures as I didn't take any... Sorry. It is pretty intuitive to set up from here as well.

I went through quite a few sites and most all have the same content so you can google rsyslog and loganalyzer and they find one. I liked his because it had pictures as well as the commands written out.

Changes: I couldn't set the mysqld to run at start up but the mariadb would so I did that (not sure if this is working yet).

Also note there is a newer version of loganalyzer than he is using.

I will be adding other servers to the logging once I get that figured out.

I had some trouble setting up the Cisco configuration on the server but all in all I got it working. This is what I ended up doing:

In the rsyslog.conf file:
Uncomment out $ModLoad imudp and $UPDServerRun 514 lines
At the bottom add the following two lines to the bottom of the file:
# # Logging for Cisco router 192.168.1.1 # local7.* /var/log/cisco
$AllowedSender UDP, 127.0.0.1, ip.of.cisco.router

Then add the file:
touch /var/log/cisco

restart the rsyslog service:
rsyslog service restart

In order to get it to show up in loganalyzer:
chmod 755 cisco (I don't remember why i did those permissions but they worked)

Make sure firewall rules allow for connections on ports 514 and 80

#not necessary
In the admin console (after the permissions are changed) add a source that looks like the following:

I also ended up opening port the default port 514 on udp for the server as I couldn't figure out why the settings were not working. I basically changed things a number of times so I am not sure when it started working but this is the ending configuration of everything.

Lastly you have to set up the Cisco part. That was pretty intuitive basically I just put the logging level I wanted as well as the IP address I was sending the logs to. Once that was done I made sure it was turned on. I was using Cisco Configuration Professional but ASDM is pretty similar in its config.

The end results!! BEHOLD!

When I rebooted I noticed my firewall was not working correctly. I opened ports 514 for TCP and UDP and everything worked again. I did this through the GUI in Fedora 20.