Posted: Sun Mar 19, 2017 1:51 Post subject: Log Control
I'm using DD-WRT v24-sp2 (03/25/13) vpn-small on a Netgear WNR2000 v2 router, and have logs being sent to a syslog server. I am interested in seeing all traffic coming in from the WAN side of the router, whether ACCEPTed or DROPped. It seems that the only way to get the ACCEPTed entries recorded is to set the log level to High, but this also enables all traffic going from the LAN to the WAN, literally tens of thousands of packets per day.
Is there a way to get more granular control over what gets logged? Not only am I concerned about wasted disk space on the syslog server, but I really don't want to have to filter all that unwanted data each day when reviewing the logs. Thanks,
Posted: Tue Mar 21, 2017 23:20 Post subject: log control
Can't wait to see if someone is able to answer or provide additional insight. I've asked some related questions to myself periodically after exploring the log functions and after looking through the log related wiki and tutorial.
I am running wall watcher right now as my syslog server and it does have some functions to help filter some of the traffic.
Posted: Sat Mar 25, 2017 16:37 Post subject: Log Control
I currently import the logs into Excel and run some macros to strip out the unwanted data - otherwise the logs are excessively huge. And while it only takes a couple of minutes per day to do this, the time still feels excessive when it is a process that should not be necessary.
Given the apparent lack of control provided by dd-wrt, I am close to replacing mine with a different router/interface. It's a shame that something as flexible and comprehensive as dd-wrt doesn't offer more control over such a rudimentary task.
Where do you get the logs from? Straight off the router using ssh or something like that? I have never gone looking for if the logs are stored in files on the router and where those would be.
Edit: Never mind. I see you must be getting them from your syslog server.
Joined: 26 Mar 2013 Posts: 1857 Location: Hung Hom, Hong Kong
Posted: Mon Mar 27, 2017 12:34 Post subject: Re: Log Control
bithead wrote:
I'm using DD-WRT v24-sp2 (03/25/13) vpn-small on a Netgear WNR2000 v2 router, and have logs being sent to a syslog server. I am interested in seeing all traffic coming in from the WAN side of the router, whether ACCEPTed or DROPped. It seems that the only way to get the ACCEPTed entries recorded is to set the log level to High, but this also enables all traffic going from the LAN to the WAN, literally tens of thousands of packets per day.
You could filter the logs using grep, right? I am doing exactly that.
I supposed your syslog server is running in a Linux environment? Just create a BASH script to parse /var/log/router.log!
In case you didn't know, you could tune /etc/rsyslog.conf to redirect all those remote log enties into a separate file, e.g., /var/log/router.log!
Code:
**** RULES ****
if ( $syslogfacility-text == 'kern' \
and $msg contains 'IN=' \
and $msg contains 'OUT=' \
) \
or $syslogfacility-text == 'gateway' \
then -/var/log/router.log
& ~
