495e845a79
Correct the rsyslog template to include timestamps in logs, ensuring compatibility with the Python parser. This change also refactors the log filtering to capture only incoming connections, significantly reducing log volume. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 7a657272-55ba-4a79-9a2e-f1ed9bc7a528 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: c2f849f9-105f-452a-bdc3-a956d102c54b Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/449cf7c4-c97a-45ae-8234-e5c5b8d6a84f/7a657272-55ba-4a79-9a2e-f1ed9bc7a528/6ZTQSoP
40 lines
1.3 KiB
Plaintext
40 lines
1.3 KiB
Plaintext
# =============================================================================
|
|
# RSYSLOG CONFIG - LOG MIKROTIK IDS
|
|
# =============================================================================
|
|
# File: /etc/rsyslog.d/99-mikrotik.conf
|
|
# Riceve log UDP:514 dai router MikroTik e li salva in file dedicato
|
|
# IMPORTANTE: Usa sintassi moderna rsyslog v8+ per evitare conflitti template
|
|
# =============================================================================
|
|
|
|
# Template personalizzato per log MikroTik (formato BSD syslog)
|
|
# Formato: Nov 22 08:15:30 HOSTNAME message
|
|
# %TIMESTAMP% genera formato: Nov 22 08:15:30
|
|
template(name="MikroTikRawFormat" type="string" string="%TIMESTAMP% %HOSTNAME% %msg%\n")
|
|
|
|
# Ruleset dedicato per log MikroTik
|
|
ruleset(name="mikrotik") {
|
|
# Salva in file dedicato usando template raw
|
|
action(
|
|
type="omfile"
|
|
file="/var/log/mikrotik/raw.log"
|
|
template="MikroTikRawFormat"
|
|
FileOwner="ids"
|
|
FileGroup="ids"
|
|
FileCreateMode="0644"
|
|
DirOwner="ids"
|
|
DirGroup="ids"
|
|
DirCreateMode="0755"
|
|
)
|
|
|
|
# STOP: Non propagare a /var/log/messages per evitare duplicati
|
|
stop
|
|
}
|
|
|
|
# Input UDP:514 per log MikroTik
|
|
module(load="imudp")
|
|
input(
|
|
type="imudp"
|
|
port="514"
|
|
ruleset="mikrotik"
|
|
)
|