ironsyslog
ironsyslog is a highly experimental integration of diverse Log-Messages Systems into a MAP-Infrastructure. The integration aims to share security related informations, given by many systems, with other network components in the [TNC architecture] 1 via IF-MAP.
ironsyslog consists of three components:
-
The "syslog server" - gets the information from the logging clients (they need to be configured to use this syslog server as the - where necessary additional - logging point)
-
An Event Processing Engine processes the different log messages as a handler for syslog events and fetches the latest information.
-
The Publisher consumes the high-level events, where the information are transformed into IF-MAP Metadata and published to a MAP server.
The metadata that ironsyslog publishes depends on the mapping defined by the rules in the event processing step.
The binary package (ironsyslog-x.x.x-bundle.zip
) of ironsyslog
is ready to run, all you need is to configure it to your needs.
If you like to build ironsyslog by your own you can use the
latest code from the GitHub repository.
Requirements
To use the binary package of ironsyslog you need the following components:
- OpenJDK Version 1.7 or higher
- MAP server implementation (e.g. [irond] 3)
- Clients logging toward the syslog server
- optionally ironGui to see whats going on
To build and comile source code by yourself Maven 3 is also needed.
Configuration
To setup the binary package you need to import the ironsyslog and MAP server
certificates into ironsyslog.jks
.
If you want to use ironsyslog with irond the keystores of both are configured
with ready-to-use testing certificates.
The remaining configuration parameters can be done through the
ironsyslog.properties
file in the ironsyslog package.
In general you have to specify:
- the syslog server ip, port and protocol where ironsyslog is supposed to be listening on,
- the MAP-Server URL and credentials.
Secondly you have to setup the rules:
- Some example rules are provided in the
rules
folder. - Configure the enabled rules in the
config.yml
For example here is a rule to extract the information if a dhcpcd event (ip-mac assertions):
rule "dhcpd DHCPACK"
when
$ise:IronSyslogServerEvent(message.contains("dhcpd"), message.contains("DHCPACK"))
then
debug("Rule \"" + drools.getRule().getName() + "\" fired.");
String message = $ise.getMessage();
Pattern p = Pattern.compile("dhcpd: DHCPACK on (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}) to (..:..:..:..:..:..) via (.*)");
Matcher m = p.matcher(message);
if (m.find()) {
String networkInterface = m.group(3);
String ipAddress = m.group(1);
String macAddress = m.group(2);
insert ( new DhcpAckEvent(ipAddress, macAddress, $ise.getHost(), networkInterface) );
}
end
The according configuration file:
# All rule files have to end with the ".drl" extension and follow the following folder structure:
\# - rules/drools/
\# - service/ : Syslog service rule for event transformation
\# - publish/ : ifmap rule for event publishing
\# - other/* : all remaining rules
\# Inside the "other" folder an arbitrary folder structure can be used
\# Services in the service/ folder to be included
serviceInclude:
- dnsmasq-dhcp
\# Publish rules in the publish/ folder to be excluded
publishExclude:
Building
You can build ironsyslog by executing:
$ mvn package
in the root directory of the ironsyslog project.
Maven should download all further needed dependencies for you. After a successful
build you should find the ironsyslog-x.x.x-bundle.zip
in the target
sub-directory.
Running
To run the binary package of ironsyslog simply execute:
$ ./start.sh
Feedback
If you have any questions, problems or comments, please contact trust@f4-i.fh-hannover.de
LICENSE
ironsyslog is licensed under the [Apache License, Version 2.0] 4.
Note
ironsyslog is an experimental prototype and is not suitable for actual use.
Feel free to fork/contribute.