Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.


I have a standard install of honeyd from Ubuntu repositories.
Honeyd is saving logs in two files:
/var/log/honeyd/honeyd.log
/var/log/honeyd/daemon.log
I have been trying to setup rsyslog to forward all logs from honeyd.log to a remote server and it is proving impossible.
My /etc/rsyslog.d/50-default.conf looks like this:

$ModLoad imfile
$InputFileName /var/log/honeypot/honeyd.log
$InputFileTag honeyd
$InputFileStateFile stat-honeyd
$InputFileSeverity debug
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
local7.* @@remoteserver:514
*.* @remoteserver

On my remote server I have created /var/rsyslog.d/honeyd.conf as so:

if $programname contains 'honeyd' then /var/log/honeyd.log
& ~

With this setup I get all the daemon logs for honeyd on the remote server (honeyd start stop) and arp reply packages for first time communication with a honeyd honeypot. However, logs from honeyd.log are not forwarded.
I have tried with UDP/TCP, making sure syslog has access to honeyd.log by adding the syslog user to the honeyd group but I just cant get it to work.
TCPdump confirms that logs from honeyd.log are not being sent.

honeyd.log entries look like this:

2013-07-10-16:31:07.5939 icmp(1) - sourceip destip: 8(0): 84
2013-07-10-16:31:08.5951 icmp(1) - sourceip destip: 8(0): 84

Does anyone know what I am missing? Thanks for any help in advance.

share|improve this question

migrated from security.stackexchange.com Jul 10 '13 at 18:32

This question came from our site for Information security professionals.

2  
Question belongs to Ask Ubuntu or SU imo, but don't see the need for down votes. –  Rohan Durve - Decode141 Jul 10 '13 at 16:58
    
@RohanDurve-Decode141 - Well I didn't feel there's any need for it either, but the downvotes on questions are removed on migration to other Stack Exchange website, so I don't see it as a problem either. If the question gathered enough downvotes to not be listed on the front page, it would make room there for another question that is on topic. ;) –  TildalWave Jul 10 '13 at 18:04
    
@TildalWave I see, right of course, wouldn't want to get into the way of that mechanic. ^_^" –  Rohan Durve - Decode141 Jul 10 '13 at 18:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.