All Apps and Add-ons

Linux Netfilter(iptables) technology add-on: How to collect logs from iptables?

test_qweqwe
Builder

Hi
Can you help me with some questions?

If I understand, this add-on parsing iptables logs, but first I need to change config of ipatables to log in to separate file?
There is no any inputs.conf or something like it. I don't know how to use this add-on even with documentation.

0 Karma
1 Solution

FrankVl
Ultra Champion

Assuming you're running splunk(forwarder) on the same box as where you want to capture the iptables logs, you'll need to:

  1. Enable and configure logging in iptables (refer to iptables docs / online guides etc. for details; first hit on google: https://www.thegeekstuff.com/2012/08/iptables-log-packets/?utm_source=feedburner)
  2. Configure the system's syslog daemon to write the iptables log to a suitable file (or at least confirm where it writes by default)
  3. Configure splunk with a file monitor input to read the respective file. I understand from the TA doc you can use the syslog sourcetype, which will be transformed to linux:netfilter by the TA.

View solution in original post

doksu
SplunkTrust
SplunkTrust

You could split the netfilter (iptables) events into their own file then in the inputs.conf monitor stanza for that file specify the sourcetype of linux:netfilter, but I designed the app so that doing so is not necessary. If you simply ingest the netfilter events mixed with other syslogged events (e.g. /var/log/messages) and that file is ingested with sourcetype "syslog", then the app will automatically change the sourcetype of just the netfilter events to linux:netfilter.

FrankVl
Ultra Champion

Assuming you're running splunk(forwarder) on the same box as where you want to capture the iptables logs, you'll need to:

  1. Enable and configure logging in iptables (refer to iptables docs / online guides etc. for details; first hit on google: https://www.thegeekstuff.com/2012/08/iptables-log-packets/?utm_source=feedburner)
  2. Configure the system's syslog daemon to write the iptables log to a suitable file (or at least confirm where it writes by default)
  3. Configure splunk with a file monitor input to read the respective file. I understand from the TA doc you can use the syslog sourcetype, which will be transformed to linux:netfilter by the TA.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.