Здравствуйте товарищи форумчане!
Помогите заставить IPTABLES + ULOG писать в базу данных MySQL
сам уже перелопатил кучю форумов нечего так и не нашел в торой день бьюсь но все без результатно
Ulog настраивал по этой инструкции
вот сылка
вот конфиг
ulogd.conf
Код: Выделить всё
carkov@mydeb:/etc$ sudo more ulogd.conf
# Example configuration for ulogd
# $Id: ulogd.conf.in 5267 2005-02-19 21:33:43Z laforge $
#
[global]
######################################################################
# GLOBAL OPTIONS
######################################################################
# netlink multicast group (the same as the iptables --ulog-nlgroup param)
nlgroup=1
# logfile for status messages
logfile="/var/log/ulog/ulogd.log"
# loglevel: debug(1), info(3), notice(5), error(7) or fatal(8)
loglevel=5
# socket receive buffer size (should be at least the size of the
# in-kernel buffer (ipt_ULOG.o 'nlbufsiz' parameter)
rmem=131071
# libipulog/ulogd receive buffer size, should be > rmem
bufsize=150000
######################################################################
# PLUGIN OPTIONS
######################################################################
# We have to configure and load all the plugins we want to use
# general rules:
# 1. load the plugins _first_ from the global section
# 2. options for each plugin in seperate section below
#
# ulogd_BASE.so - interpreter plugin for basic IPv4 header fields
# you will always need this
plugin="/usr/lib/ulogd/ulogd_BASE.so"
# output plugins.
#plugin="/usr/lib/ulogd/ulogd_LOGEMU.so"
#plugin="/usr/lib/ulogd/ulogd_OPRINT.so"
plugin="/usr/lib/ulogd/ulogd_MYSQL.so"
#plugin="/usr/lib/ulogd/ulogd_PGSQL.so"
#plugin="/usr/lib/ulogd/ulogd_SQLITE3.so"
#plugin="/usr/lib/ulogd/ulogd_PCAP.so"
[LOGEMU]
file="/var/log/ulog/syslogemu.log"
sync=1
[OPRINT]
file="/var/log/ulog/pktlog.log"
[MYSQL]
table="ulog"
pass="changeme"
user="laforge"
db="ulogd"
host="localhost"
[PGSQL]
table="ulog"
schema="public"
pass="changeme"
user="postgres"
db="ulogd"
host="localhost"
[SQLITE3]
table="ulog"
db="/path/to/sqlite/db"
buffer=200
[PCAP]
file="/var/log/ulog/pcap.log"
sync=1
а вот логи /var/log/ulog/ulogd.log
Код: Выделить всё
carkov@mydeb:/var/log/ulog$ more ulogd.log
Thu Mar 26 22:29:13 2015 <5> ulogd.c:594 sigterm received, exiting
Thu Mar 26 22:29:14 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Thu Mar 26 22:47:32 2015 <5> ulogd.c:594 sigterm received, exiting
Thu Mar 26 22:47:33 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Thu Mar 26 22:48:43 2015 <5> ulogd.c:594 sigterm received, exiting
Thu Mar 26 22:48:44 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Thu Mar 26 23:00:22 2015 <5> ulogd.c:594 sigterm received, exiting
Thu Mar 26 23:00:55 2015 <7> ulogd_MYSQL.c:430 can't establish database connection
Sat Mar 28 00:32:12 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 00:32:44 2015 <7> ulogd_MYSQL.c:430 can't establish database connection
Sat Mar 28 00:33:47 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 00:34:21 2015 <7> ulogd_MYSQL.c:430 can't establish database connection
Sat Mar 28 13:48:05 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 13:48:06 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 13:59:30 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 13:59:31 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 14:10:29 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 14:10:30 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 14:28:38 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 14:28:39 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 14:41:39 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 14:41:40 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 15:43:21 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 15:43:54 2015 <7> ulogd_MYSQL.c:430 can't establish database connection
Sat Mar 28 17:20:27 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 17:20:28 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 17:21:03 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 17:21:36 2015 <7> ulogd_MYSQL.c:430 can't establish database connection
Sat Mar 28 18:38:57 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 18:38:59 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
Sat Mar 28 18:40:12 2015 <5> ulogd.c:594 sigterm received, exiting
Sat Mar 28 18:40:13 2015 <7> ulogd_MYSQL.c:436 unable to get mysql columns
скажите что этот логи обозначаю что
ulogd неможет подключится к базе данных я так понемаю и то что он неможет там создать таблицы?
Базу данных и пользователя создал коммандами
залогинился под root-ом в базу mysql
Код: Выделить всё
>create database ulogd;
Query OK, 1 row affected (0.00 sec)
>grant all on ulogd.* to laforge@localhost identified by 'changeme';
Query OK, 0 rows affected (0.03 sec)
дистр дебиан wheezy
nulog не устанавлива может из за него не работает?
помогите пожалуйста победить эту проблему
буду рад любой помощи
