Home | Mirror | Search

Python Syslog Server

Mr. Neo Chen (netkiller), 陳景峰(BG7NYT)


中國廣東省深圳市龍華新區民之街道溪山美地
518109
+86 13113668890
+86 755 29812080

摘要

本程序用於收集,防火牆,路由器,交換機等日誌


目錄

1. 配置Cisco ASA 5550 Firewall
2. syslog 伺服器腳本

1. 配置Cisco ASA 5550 Firewall

logging enable 
logging timestamp 
logging trap warnings 
logging host inside 172.16.0.5
logging facility local0 
		

172.16.0.5 改為你的syslog伺服器地址

2. syslog 伺服器腳本

*注意:python版本必須3.0以上

chmod 700 syslogd

./syslogd

		
#!/srv/python/bin/python3
# -*- encoding: utf-8 -*-
# Cisco ASA Firewall - Syslog Server by neo
# Author: neo<neo.chen@live.com>

import logging
import socketserver
import threading

LOG_FILE = '/var/log/asa5550.log'

logging.basicConfig(level=logging.INFO,
                    format='%(message)s',
                    datefmt='',
                    filename=LOG_FILE,
                    filemode='a')

class SyslogUDPHandler(socketserver.BaseRequestHandler):

    def handle(self):
        data = bytes.decode(self.request[0].strip())
        socket = self.request[1]
        print( "%s : " % self.client_address[0], str(data))
        logging.info(str(data))
#        socket.sendto(data.upper(), self.client_address)

if __name__ == "__main__":
    try:
        HOST, PORT = "0.0.0.0", 514
        server = socketserver.UDPServer((HOST, PORT), SyslogUDPHandler)
        server.serve_forever(poll_interval=0.5)
    except (IOError, SystemExit):
        raise
    except KeyboardInterrupt:
        print ("Crtl+C Pressed. Shutting down.")
		
		
comments powered by Disqus