Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.


I have a standard install of honeyd from Ubuntu repositories.
Honeyd is saving logs in two files:
/var/log/honeyd/honeyd.log
/var/log/honeyd/daemon.log
I have been trying to setup rsyslog to forward all logs from honeyd.log to a remote server and it is proving impossible.
My /etc/rsyslog.d/50-default.conf looks like this:

$ModLoad imfile
$InputFileName /var/log/honeypot/honeyd.log
$InputFileTag honeyd
$InputFileStateFile stat-honeyd
$InputFileSeverity debug
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
local7.* @@remoteserver:514
*.* @remoteserver

On my remote server I have created /var/rsyslog.d/honeyd.conf as so:

if $programname contains 'honeyd' then /var/log/honeyd.log
& ~

With this setup I get all the daemon logs for honeyd on the remote server (honeyd start stop) and arp reply packages for first time communication with a honeyd honeypot. However, logs from honeyd.log are not forwarded.
I have tried with UDP/TCP, making sure syslog has access to honeyd.log by adding the syslog user to the honeyd group but I just cant get it to work.
TCPdump confirms that logs from honeyd.log are not being sent.

honeyd.log entries look like this:

2013-07-10-16:31:07.5939 icmp(1) - sourceip destip: 8(0): 84
2013-07-10-16:31:08.5951 icmp(1) - sourceip destip: 8(0): 84

Does anyone know what I am missing? Thanks for any help in advance.

share|improve this question
2  
Question belongs to Ask Ubuntu or SU imo, but don't see the need for down votes. –  Rohan Durve - Decode141 Jul 10 '13 at 16:58
    
@RohanDurve-Decode141 - Well I didn't feel there's any need for it either, but the downvotes on questions are removed on migration to other Stack Exchange website, so I don't see it as a problem either. If the question gathered enough downvotes to not be listed on the front page, it would make room there for another question that is on topic. ;) –  TildalWave Jul 10 '13 at 18:04
    
@TildalWave I see, right of course, wouldn't want to get into the way of that mechanic. ^_^" –  Rohan Durve - Decode141 Jul 10 '13 at 18:14
add comment

migrated from security.stackexchange.com Jul 10 '13 at 18:32

This question came from our site for Information security professionals.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.