Hi Hoba !
I haven't solved anythink, just modify my pfsense box to do what in need…
I have understand why the logs are in ram and why clog generate circular log files.
This is the start of my work... in a 1.2 Rc2 realease.
Suggestions are welcome !
Do not try it if you have no enought space on your Hdd !
1, Install ssmtp :
#setenv PACKAGESITE ftp://ftp4.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/Latest/
#pkg_add -r redir
#pkg_add -r ssmtp
2, rename the conf file /usr/local/etc/ssmtp.conf.sample to ssmtp.conf
Modify this file (give your smtp server parameters).
this is my ssmtp.conf file:
/etc/ssmtp.conf -- a config file for sSMTP sendmail. The person who gets all mail for userids < 1000 Make this empty to disable rewriting.root=
The place where the mail goes. The actual machine name is required no MX records are consulted. Commonly mailhosts are named mail.domain.com The example will fit if you are in domain.com and your mailhub is so named. Example for SMTP port number 2525 mailhub=mail.your.domain:2525 Example for SMTP port number 25 (Standard/RFC)mailhub=smtp.wanadoo.fr:25
Example for SSL encrypted connection mailhub=mail.your.domain:465 Where will the mail seem to come from?#rewriteDomain=
The full hostname#hostname=
Set this to never rewrite the "From:" line (unless not given) and to use that address in the "from line" of the envelope.FromLineOverride=YES
Use SSL/TLS to send secure messages to server.#UseTLS=YES
Use SSL/TLS certificate to authenticate against smtp host.#UseTLSCert=YES
Use this RSA certificate. #TLSCert=/usr/local/etc/ssmtp/ssmtp.pemI 've just modify the mailhub= , and uncomment FromLineOverride=YES
3, Install syslog-ng
#pkg_add -r syslog-ng
this is my conf, not finished, i cath all log to messages logs).
This is just an example... This sample configuration file is essentially equilivent to the stock FreeBSD /etc/syslog.conf file.
options { long_hostnames(off); sync(0); };
sourcessource src { unix-dgram("/var/run/log");
unix-dgram("/var/run/logpriv" perm(0600));
udp(); internal(); file("/dev/klog"); };
destination firewall { file("/log/$DAY$MONTH$YEAR/filter.log"
create_dirs(yes)); };
destination vpn { file("/log/$DAY$MONTH$YEAR/vpn.log"
create_dirs(yes)); };
destination portalauth { file("/log/$DAY$MONTH$YEAR/portalauth.log"
create_dirs(yes)); };
destination dhcp { file("/log/$DAY$MONTH$YEAR/dhcpd.log"
create_dirs(yes)); };
destination messages { file("/log/$DAY$MONTH$YEAR/messages.log"
create_dirs(yes)); };
destination cron { file("/log/$DAY$MONTH$YEAR/cron.log"
create_dirs(yes)); };
destination auth { file("/log/$DAY$MONTH$YEAR/auth.log"
create_dirs(yes)); };
destination sshlockout { program("/usr/local/sbin/sshlockout_pf"); };
destination ntpd { file("/log/$DAY$MONTH$YEAR/ntpd.log"
create_dirs(yes)); };
destination ipsec { file("/log/$DAY$MONTH$YEAR/ipsec.log"
create_dirs(yes)); };
destination openvpn { file("/log/$DAY$MONTH$YEAR/openvpn.log"
create_dirs(yes)); };
filter f_emerg { level (emerg); };
filter f_alert { level (alert .. emerg); };
filter f_crit { level (crit .. emerg); };
filter f_err { level (err .. emerg); };
filter f_warning { level (warning .. emerg); };
filter f_notice { level (notice .. emerg); };
filter f_auth { facility(auth, authpriv); };
filter f_authpriv { facility(authpriv); };
filter f_syslog { facility (syslog); };
filter f_cron { facility (cron); };
#filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); };
filter ntp {program (ntpd); };
filter f_racoon {program (racoon); };
filter f_openvpn {program (openvpn); };
#filter f_firewall-drop { facility (local0) and match("drop"); };
filter f_firewall-pass { facility (local0) and match("pass"); };
log { source(src); filter(f_firewall-pass); destination(firewall); };
log { source(src); filter(f_local3); destination(vpn); };
log { source(src); filter(f_local4); destination(portalauth); };
log { source(src); filter(f_local7); destination(dhcp); };
#log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_auth); destination(auth); };
log { source(src); filter(f_auth); destination(sshlockout); };
log { source(src); filter(ntp); destination(ntpd); };
log { source(src); filter(f_racoon); destination(ipsec); };
log { source(src); filter(f_openvpn); destination(openvpn); };
log { source(src); destination(messages); };
5, modify the /etc/rc file, comment the creation of clog files
(or better test if syslog-ng exist and do an else / then
#if [ ! "$PLATFORM" = "cdrom" ]; then
clog -i -s 512144 /var/log/system.log clog -i -s 512144 /var/log/filter.log clog -i -s 65535 /var/log/dhcpd.log clog -i -s 65535 /var/log/vpn.log clog -i -s 65535 /var/log/openvpn.log clog -i -s 65535 /var/log/portalauth.log clog -i -s 65535 /var/log/ipsec.log clog -i -s 65535 /var/log/slbd.log clog -i -s 65535 /var/log/lighttpd.log clog -i -s 65535 /var/log/ntpd.log#else
# clog -i -s 65535 /var/log/system.log
# clog -i -s 65535 /var/log/filter.log
# clog -i -s 65535 /var/log/dhcpd.log
# clog -i -s 65535 /var/log/vpn.log
# clog -i -s 65535 /var/log/portalauth.log
# clog -i -s 65535 /var/log/ipsec.log
# clog -i -s 65535 /var/log/slbd.log
#fi
change permissions on newly created clog files.#chmod 0600 /var/log/system.log /var/log/filter.log /var/log/dhcpd.log /var/log/vpn.log /var/log/portalauth.log /var/log/slbd.log
6, start syslog-ng (you can insert it before the cron start)
echo -n "Starting Syslog-ng… "
/usr/local/sbin/syslog-ng
echo "done.
7, modify the /etc/rc.bootup and comment the original syslog start
/* start syslogd */
/system_syslogd_start();/
8, stop syslogd and start syslog-ng to test if all is ok
9, reboot.
A this time you have syslog-ng working on your system, and you can send mail.
you can make your own script to send the log by mail, and rotate the logs files...
I've make a little script for me who send the log by mail, and delete directory older than one year...
#!/bin/sh
#Require ssmtp & syslog-ng
path=/log/$(date '+%d%m%Y')
Les variables des datesjour=$(date '+%d%m')
annee=$(date '+%Y')
anterieur=$(($annee-1))
email=oui
expediteur=xxx@wanadoo.fr
destinataire=xxx@mkws.net
sujet='Log Wifi du '$jour$annee''
if cat $path/portalauth.log | grep -a logportalauth > /dev/null;
then echo -e "From:$expediteur\nTo:$destinataire\nSubject:$sujet\n" > $path/$jour$annee.log
echo -e "\nPortail Captif:" | tee -a $path/$jour$annee.log > /dev/null
cat $path/portalauth.log | grep -a logportalauth | tee -a $path/$jour$annee.log > /dev/null
echo -e "\nServeur Dhcp:" | tee -a $path/$jour$annee.log > /dev/null
cat $path/dhcpd.log | grep -a DHCPACK | tee -a $path/$jour$annee.log > /dev/null
echo -e "\nPare-feu:" | tee -a $path/$jour$annee.log > /dev/null
cat $path/filter.log | grep -a rule | tee -a $path/$jour$annee.log > /dev/null
else echo -e "From:$expediteur\nTo:$destinataire\nSubject:$sujet\n" > $path/$jour$annee.log
echo -e "\nPortail Captif:" | tee -a $path/$jour$annee.log > /dev/null
echo "Pas de connexion au portail captif aujourd'ui!" | tee -a $path/$jour$annee.log > /dev/null
fi
case $email in
oui)
/usr/local/sbin/ssmtp $destinataire < $path/$jour$annee.log;;
non)
;;
esac
#On verifie l'existence du répertoire de l'année antérieur et on le supprime
[ -d $path/$jour$anterieur ]&& rm -Rf $path/$jour$anterieur
–---------------------------------------------------------------------------------------------------
Marc
