Name

syslog2iptables.conf — configuration file for syslog2iptables

Synopsis

syslog2iptables.conf

Description

The syslog2iptables.conf configuration file is specified by this partial bnf description.

CONFIG    := {THRESHOLD | IGNORE | FILE}+
THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";"
IGNORE    := "ignore" "{" IG-SINGLE+ "};"
IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";"
FILE      := "file" FILENAME "{" PATTERN+ "};"
PATTERN   := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET}+ "};"
INDEX     := "index" REGEX-INTEGER-VALUE ";"
BUCKET    := "bucket" BUCKET-ADD-INTEGER-VALUE ";"

Sample

threshold 550;

ignore {
    127.0.0.0/8;        // localhost
};

file "/var/log/cisco.log" {
    pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
        index 2;    // zero based
        bucket 200;
    };
};

file "/var/log/secure" {
    pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
        index 1;    // zero based
        bucket 400;
    };
    pattern "sshd.*Failed password .* from (.*) port" {
        index 1;    // zero based
        bucket 400;
    };
};