can i make all log from console have date stamp
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban. thanks.
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o What're you looking to capture? FS already has log messages for auth failures for fail2ban to match On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
i try ssh dos and that give log in tport. but log about tport tls didnt have any data/time stamp. maybe if i can make that log into date/time stamp i can make regex for fail2ban to find log when attacker give new connection in tls eventually. am i need to change in tport_type_tls.c in line about SU_DEBUG_5 that have part with "new connection from " and change that with switch_log_printf. but actually i dont really understand about C. so how i can change that with switch_log_printf? Thanks On Wed, Apr 2, 2014 at 3:35 PM, Steven Ayre <steveayre@gmail.com> wrote:
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o
What're you looking to capture?
FS already has log messages for auth failures for fail2ban to match
On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
sorry, i mean ssl dos. if i use that, that give cpu activity increase to 100%. i want to make that log so i can use fail2ban to ban source IP attacker On Wed, Apr 2, 2014 at 5:02 PM, dwi yulianto <dwiyulianto.anto@gmail.com>wrote:
i try ssh dos and that give log in tport. but log about tport tls didnt have any data/time stamp.
maybe if i can make that log into date/time stamp i can make regex for fail2ban to find log when attacker give new connection in tls eventually.
am i need to change in tport_type_tls.c in line about SU_DEBUG_5 that have part with "new connection from " and change that with switch_log_printf. but actually i dont really understand about C. so how i can change that with switch_log_printf?
Thanks
On Wed, Apr 2, 2014 at 3:35 PM, Steven Ayre <steveayre@gmail.com> wrote:
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o
What're you looking to capture?
FS already has log messages for auth failures for fail2ban to match
On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If you file a feature request for a freeswitch event to be fired when a new TLS connection is made, one of the developers might be able to look into adding that functionality. Then you would be able to hook in mod_fail2ban and log the events you are looking to have watched by fail2ban. William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com On 04/02/2014 03:29 AM, dwi yulianto wrote:
sorry, i mean ssl dos.
if i use that, that give cpu activity increase to 100%.
i want to make that log so i can use fail2ban to ban source IP attacker
On Wed, Apr 2, 2014 at 5:02 PM, dwi yulianto <dwiyulianto.anto@gmail.com <mailto:dwiyulianto.anto@gmail.com>> wrote:
i try ssh dos and that give log in tport. but log about tport tls didnt have any data/time stamp.
maybe if i can make that log into date/time stamp i can make regex for fail2ban to find log when attacker give new connection in tls eventually.
am i need to change in tport_type_tls.c in line about SU_DEBUG_5 that have part with "new connection from " and change that with switch_log_printf. but actually i dont really understand about C. so how i can change that with switch_log_printf?
Thanks
On Wed, Apr 2, 2014 at 3:35 PM, Steven Ayre <steveayre@gmail.com <mailto:steveayre@gmail.com>> wrote:
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o
What're you looking to capture?
FS already has log messages for auth failures for fail2ban to match
On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com <mailto:dwiyulianto.anto@gmail.com>> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
thanks all for reply, i will try to ask that to developer. On Thu, Apr 3, 2014 at 12:07 AM, William King <william.king@quentustech.com>wrote:
If you file a feature request for a freeswitch event to be fired when a new TLS connection is made, one of the developers might be able to look into adding that functionality. Then you would be able to hook in mod_fail2ban and log the events you are looking to have watched by fail2ban.
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 04/02/2014 03:29 AM, dwi yulianto wrote:
sorry, i mean ssl dos.
if i use that, that give cpu activity increase to 100%.
i want to make that log so i can use fail2ban to ban source IP attacker
On Wed, Apr 2, 2014 at 5:02 PM, dwi yulianto <dwiyulianto.anto@gmail.com <mailto:dwiyulianto.anto@gmail.com>> wrote:
i try ssh dos and that give log in tport. but log about tport tls didnt have any data/time stamp.
maybe if i can make that log into date/time stamp i can make regex for fail2ban to find log when attacker give new connection in tls eventually.
am i need to change in tport_type_tls.c in line about SU_DEBUG_5 that have part with "new connection from " and change that with switch_log_printf. but actually i dont really understand about C. so how i can change that with switch_log_printf?
Thanks
On Wed, Apr 2, 2014 at 3:35 PM, Steven Ayre <steveayre@gmail.com <mailto:steveayre@gmail.com>> wrote:
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o
What're you looking to capture?
FS already has log messages for auth failures for fail2ban to match
On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com <mailto:dwiyulianto.anto@gmail.com>> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:
http://lists.freeswitch.org/mailman/options/freeswitch-users
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You can't. It's the underlying sip stack. It doesn't link against libfreeswitch so that function is not available On Wednesday, April 2, 2014, dwi yulianto <dwiyulianto.anto@gmail.com> wrote:
i try ssh dos and that give log in tport. but log about tport tls didnt have any data/time stamp.
maybe if i can make that log into date/time stamp i can make regex for fail2ban to find log when attacker give new connection in tls eventually.
am i need to change in tport_type_tls.c in line about SU_DEBUG_5 that have part with "new connection from " and change that with switch_log_printf. but actually i dont really understand about C. so how i can change that with switch_log_printf?
Thanks
On Wed, Apr 2, 2014 at 3:35 PM, Steven Ayre <steveayre@gmail.com<javascript:_e(%7B%7D,'cvml','steveayre@gmail.com');>
wrote:
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o
What're you looking to capture?
FS already has log messages for auth failures for fail2ban to match
On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com<javascript:_e(%7B%7D,'cvml','dwiyulianto.anto@gmail.com');>> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<javascript:_e(%7B%7D,'cvml','consulting@freeswitch.org');> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<javascript:_e(%7B%7D,'cvml','FreeSWITCH-users@lists.freeswitch.org');> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It'd be better to modify the stack to expose the functionality you need and then handle that in mod_sofia On Wednesday, April 2, 2014, Steven Ayre <steveayre@gmail.com> wrote:
You can't. It's the underlying sip stack. It doesn't link against libfreeswitch so that function is not available
On Wednesday, April 2, 2014, dwi yulianto <dwiyulianto.anto@gmail.com<javascript:_e(%7B%7D,'cvml','dwiyulianto.anto@gmail.com');>> wrote:
i try ssh dos and that give log in tport. but log about tport tls didnt have any data/time stamp.
maybe if i can make that log into date/time stamp i can make regex for fail2ban to find log when attacker give new connection in tls eventually.
am i need to change in tport_type_tls.c in line about SU_DEBUG_5 that have part with "new connection from " and change that with switch_log_printf. but actually i dont really understand about C. so how i can change that with switch_log_printf?
Thanks
On Wed, Apr 2, 2014 at 3:35 PM, Steven Ayre <steveayre@gmail.com> wrote:
Sofia stack logging is extremely verbose, far more so than you want to run in production. Doing so will likely hurt the performance of your system due to too much disk I/o
What're you looking to capture?
FS already has log messages for auth failures for fail2ban to match
On Tuesday, April 1, 2014, dwi yulianto <dwiyulianto.anto@gmail.com> wrote:
i wanna make log from tport.c in console or in log file with date stamp, so i can use it for fail2ban.
thanks.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (3)
-
dwi yulianto
-
Steven Ayre
-
William King