.
loganalyzer-4.1.5/ChangeLog 0000664 0000000 0000000 00000134447 12777402504 0015647 0 ustar 00root root 0000000 0000000 ---------------------------------------------------------------------------
Version 4.1.5 (stable), 2016-10-12
- Fixed compaitiblity issues related to PHP7.
- Updated JPGraph to 4.0.1 (to fix PHP7 support).
- Changed all mysql_* API calls to mysqli_* API.
- Fixed several possible XSS exploit issues in report modules and
chart generator.
- Updated JQUERY to v1.12.4 and fixed issues with the loading widget.
- Fixed case sensitive speling issue in logstream disk helper functions.
- Fixed a bug when using the clear data function in UserDB Sources Admin.
---------------------------------------------------------------------------
Version 4.1.3 (beta), 2015-03-26
- Fixed REGEX Filtering issue, see #bugid 536.
- Added Autofocus functions for formelemts in certain admin panel areas.
- Reorganized Search Form.
---------------------------------------------------------------------------
Version 4.1.2 (beta), 2015-02-23
- Corrected error handling in chartgenerator.
- Fixed minor issues in database layout template.
- Fixed missing buttons in database mapping admin panel.
- Fixed MSIE8 Display Issue with buttons on main page.
- Fixed some strings in german translation.
- Increased javascript script performance for Firefox, MSIE and Opera.
- Removed broken Page Number display support.
- Fixed #bugid 532, report generation problem with special html characters.
- Fixed #bugid 533 in dbmapping admin panel.
- Fixed Installation #bugid 518 when $ character was used in any setting.
- Fixed #bugid 494 and 311, added support for detecting more timestamps
in RFC5424 Parser. Also adding structured data to the
message field if available.
- Fixed #bugid 320, added workaround for report admin panel
when using MSIE8, as it incorrectly handles buttons.
- Fixed multiple PHP 5.5 deprecated issues with preg_replace calls.
- Fixed DNS Cache which did not work properly in some PHP versions.
- Fixed deprecated issues in html2pdf converte.
---------------------------------------------------------------------------
Version 4.1.1 (beta), 2014-10-29
- Included jquery library into Loganalyzer
- Included jquery-ui library into Loganalyzer
- Message Popup Window is a jquery-iu dialog now.
- Almost all Buttons and Menus are based on jquery-ui now.
- Added support to set a custom font and fontsize
- Added new style/theme called "High Contrast", which can be used
for people with debility of sight.
- Setting Page Reloadtime to 0 will now disable the automatic reload.
- Chart (Statistics) are loading with jquery now.
- Chart erroroutput is now HTML.
- Cleaned up layout of all admin templates
- Fixed Tab-Order in Search template.
- Added missing Alt-Text to some images in htmlcode.
- Added loading overlay to jquery menu and link click functions.
- Cleanup stylesheets and removed unused csscode.
- Changed german language files to UTF8
---------------------------------------------------------------------------
Version 3.6.6 (stable), 2014-09-02
- Fixed bug in databasemapping admin. The form parameter and database
fieldname of EventID field were interfering.
- Fixed a bug in maintenance.php, the ID parameter was forced to
an integer. A leftover from earlier loganalyzer days.
- Fixed Cross Site Scripting Issue in index.php/detail.php for
stringtype fields discovered by Dolev Farhi dolevf@yahoo.com
from F5 Networks.
---------------------------------------------------------------------------
Version 3.6.5 (stable), 2013-10-08
- LogStreamDB Driver, LogStreamPDO Driver, UserDB:
Added backticks arround tablenames in all SQL Statements.
This fixes http://bugzilla.adiscon.com/show_bug.cgi?id=479
- LogStreamPDO Driver: Fixed hardcoded tablename in trigger
create statement
- Fixed LDAP login problem when special characters like quotes were
used in passwords.
This fixes http://bugzilla.adiscon.com/show_bug.cgi?id=480
---------------------------------------------------------------------------
Version 3.6.4 (stable), 2013-08-16
- Added MYSQL hint in install script when enabling User Database System.
- Using default header encoding in GetStringWithHTMLCodes() function now.
This should solve http://bugzilla.adiscon.com/show_bug.cgi?id=433.
- Added SyslogNG logline parser, thanks to Mulyadi Santosa for
providing the a patch to us. A customized template in SyslogNG is needed:
template("$FACILITY_NUM $LEVEL_NUM $DATE $FULLHOST $MESSAGE\n")
---------------------------------------------------------------------------
Version 3.6.3 (stable), 2013-02-25
- Updated Search documentation
- Fixed Bug in the ApplyFilters function which applies to all logstreams.
This caused most REGEX filters to fail, if supported by the
LogStream driver.
- Added support for dynamic fields in MongoDB logstream sources. This
enables Loganalyzer to view data written by rsyslog into
MongoDB from CEE sources.
- Fixed wrong UID calculation in MongoDB Logstream class.
- Fixed an issue deleting all data in MongoDB LogStream class.
---------------------------------------------------------------------------
Version 3.6.2 (stable), 2013-01-09
- Fixed another DiskAllowed Checked in Disk logstream class, no works as
expected.
- Fixed Cross Site Scripting Issue in userchange.php
(viewid parameter)
---------------------------------------------------------------------------
Version 3.6.1 (stable), 2012-12-19
- Cosmetic fix in login.php, fixed static language strings.
- Fixed Cross Site scripting issue in asktheoracle.php
(oracle_query parameter)
---------------------------------------------------------------------------
Version 3.6.0 (stable), 2012-12-04
- Bugfix: Fixed "DiskAllowed" checking in Disklogstream. Filenames are now
correctly checked against allowed folders. This check was added for
security reasons before.
- Fixes #bugid 369: http://bugzilla.adiscon.com/show_bug.cgi?id=369
The DefaultviewID was accidentally overwritten with default value.
- Fixes #bugid 375: http://bugzilla.adiscon.com/show_bug.cgi?id=369
User and Group data is now deleted when removing them from the UserDB.
- Bugfix: Added missing dependency for the Checksum field in
"EventLog Audit" and "EventLog Logon/Logoff" report.
---------------------------------------------------------------------------
Version 3.5.6 (beta), 2012-09-10
- bugfix: Changed intval() handling in details.php into is_numeric.
This fixes problems with 64 Bit unsigned uid's.
Fixes #bugid 345: http://bugzilla.adiscon.com/show_bug.cgi?id=345
---------------------------------------------------------------------------
Version 3.4.5 (stable), 2012-09-10
- Merged fix from beta branch in function_db.php. DB_RemoveBadChars
function supports arrays now, this caused invisible notice errors.
---------------------------------------------------------------------------
Version 3.5.5 (beta), 2012-06-19
- Merged security fixes into beta branch
---------------------------------------------------------------------------
Version 3.4.4 (stable), 2012-06-19
- Fixed cross-site scripting vulnerability of highlight parameter
on index.php page.
---------------------------------------------------------------------------
Version 3.5.4 (beta), 2012-05-22
- Merged security fixes into beta branch
---------------------------------------------------------------------------
Version 3.4.3 (stable), 2012-05-22
- Fixed several security vulnerabilities discovered by Filippo Cavallarin.
This contains the following fixes:
- Fixed SQL Injection vulnerability in admin/view.php
- Fixed Cross Site scripting issue filter parameter on index.php
- Fixed Cross site scripting issue of id parameter on admin/reports.php
- Fixed Cross site scripting issue of id parameter on admin/searches.php
- Fixed arbitrary file read issue in Disk LogStream class.
The config.php file does now contain an array "DiskAllowed" which
contains allowed directories. Only files located within these allowed
directories can be accessed in LogAnalyzer. By default,
only /var/log is allowed.
---------------------------------------------------------------------------
Version 3.5.3 (beta), 2012-05-09
- Fixed some issues in the new MongoDB Logstream Class. To name a few,
add resultlimits to speedup performance. Changed and fixed some issues
when grouping data for consolidation. Added support to create Indexes
on fields. This should also speedup report generation.
- Added support to filter by date string, example: timereported:=2012-01-01
A new Datetype hasbeen added to support filtering by date.
- Updated jpgraph code to latest version which is 3.0.7
---------------------------------------------------------------------------
Version 3.4.2 (stable), 2012-05-07
- Fixed a #bugid 303, VerifyChecksumTrigger function in logstreamdb
class did not generate a lowercase triggername.
- Fixed typo in lang files
- Changed processid field type to string in logstreamclass. Filtering
for non-numeric processids is now possible.
- Added support to filter by day (Date field - for example:
timereported:=2012-01-01
---------------------------------------------------------------------------
Version 3.5.2 (beta), 2012-04-23
- Added new Logstream driver for MongoDB. The initial version contains
all features needed to use MongoDB with Loganalyzer and it's reports.
You will need the Mongo PHP extension installed (see here for more:
http://www.php.net/manual/en/mongo.installation.php ).
- Extended ID Field handling in Loganalyzer which is needed in order
to work with MongoDB IDs.
- Changed processid field type to string in logstreamclass.
This caused problems when filtering for non-numeric processids.
- Added support to use MongoDB logstream in LogAnalyzer installer.
---------------------------------------------------------------------------
Version 3.5.1 (beta), 2012-03-16
- Added Support for LDAP Authentication based on the modification
from forum user "Prune". LDAP Support can be configured during the
installation of LogAnalyzer, but can also be turned on later by
editing the config.php. More Details will be found in our wiki:
http://wiki.rsyslog.com/index.php/LogAnalyzer
- Fixed a #bugid 303, VerifyChecksumTrigger function had trouble
with mixed cased triggernames.
---------------------------------------------------------------------------
Version 3.5.0 (beta), 2012-01-24
- Added new Report "Eventlog Audit Summary Report" which can generate
detailed security reports for Windows Eventlog security records.
It supports Windows 2003 and 2008 Server and is compliant with the
Sarbanes-Oxley (SOX) Act, 2002.
- Added support for customized boolean report filters. This enhancement
is also used by the new "Eventlog Audit Summary Report".
---------------------------------------------------------------------------
Version 3.4.1 (stable), 2012-01-10
- Fixed a bug in Syslog and Eventlog summary report which consolidated
wrong events when the source filter was used in the report.
---------------------------------------------------------------------------
Version 3.4.0 (stable), 2011-12-06
- Added initial version of a new free report for consolidating
Windows Eventlog Logon / Logoff events
- PDO LogStream, the RowCount function is now only used
with MYSQL, PGSQL and MSSQL. Other PDO Drivers may not return a
useful value.
- Removed language files from source, can be found here from now on:
http://loganalyzer.adiscon.com/translations
- Straighten out a couple of issues
- Doc: Redirected professional support options to proper page
---------------------------------------------------------------------------
Version 3.2.3 (stable), 2011-11-08
- Removed magic quotes check from database functions (obselete due
the changes in the last version)
- Merged Changes from BUGID #288 (Thanks to User Jeff)
- Fixed internal Filter parsing bug introduced in 3.2.2.
- Fixed bug in syslog summary report missing checksum in report generation
- Fixed bug in preparing filters for display in basic report class
- Fixed bug in verification routine of sources admin when backslashes
were in any other variables
- Fixed BUGID #291, custom filters are now taken care in database
logstream sources when cleaning up data.
- Changed minwidth for context menus from 200 to 250px due display
problems in some browsers.
---------------------------------------------------------------------------
Version 3.2.2 (stable), 2011-09-28
- Implemented support to use User or Group configured logstream sources
in commandline report generator (cmdreportgen.php). The Report Admin
will generate an additional parameter for the sample commandline:
userid=$uid or groupid=$gid
- Fixed syntaxlogic bugs in proxy utilisation, thanks to forum
member pierre: http://kb.monitorware.com/post-t10570.html#p20033
- Fixed ignoring "IPAddressResolve" setting when "EnableContextLinks"
was disabled.
- Fixed filter detection bug in report class which could lead to problems
with certain filter evaluations.
- Fixed error in parsing include/exclude filters for numeric fields
in report admin panel. Changes in the main filter parser were
also necessary to fix this issue.
- Added function to automatically remove MagicQuotes (performed if
the php "magic_quotes_gpc" is on).
- Added support to search for full phrases instead of words only. Kindly
use Quotes to mark the start and end of a phrase, for example:
"Search for this" // Searches for full phrase
-"Search for this" // Excludes full phrase
- Report admin, fixed filter editor issues when full phrase strings
(with spaces) were configured.
- Report admin, the custom filterstring was not saved if new report
was created or the previous custom filterstring was empty.
---------------------------------------------------------------------------
Version 3.2.1 (stable), 2011-04-12
- Fixed timezone parsing in GetEventTime function. This caused problems
reading date/time strings with negative timezone offsets.
- Added option to disable context links in LogAnalyzer.
---------------------------------------------------------------------------
Version 3.2.0 (stable), 2011-03-30
- Added new logline parser for Syslog23 Format (RFC 5424). This format
is suported by the RSYSLOG_SyslogProtocol23Format template in RSyslog.
This format also includes syslog facility and priority.
- Added php session_write_close to certain places to avoid hanging
browser sessions.
- Eventlog Summary Report now also detects and processes data from
EventLog Monitor V2 (from EventReporter/MonitorWare Agent).
- Fixed typo in Syslog Report, Last Occurrence date is now correctly
printed in the report.
---------------------------------------------------------------------------
Version 3.0.7 (beta), 2011-02-25
- Added UserDBPort Parameter into DB_Connect function. Thanks to forum
user "plebreton" pointing to this bug.
- Added Output of report generation time into templates and common
report variabes.
- Fixed a bug in logstream DB causing unnecessary mysql_free_result
calls when updating Checksum data.
- Fixed filter dialog issue parsing message filters wrong in Report
Admin Panel. An semicolon was added while saving report settings.
- Added missing mapping for ProcessID field for monitorware database
mapping (logstream constants).
---------------------------------------------------------------------------
Version 3.0.6 (beta), 2011-02-11
- Added missing filterstring url parameter into statistics.php.
- You can enabled/disable charts by clicking on the checkbox now in
the Charts Admin panel.
- Added support to select character encoding in HTML Header. This enables
Loganalyzer to process and display UTF-8 encoded logs properly.
The default encoding is ISO-8859-1 and can be switched in the general
admin panel, or by adding the $CFG['HeaderDefaultEncoding'] configuration
variable into config.php. Possible values are ENC_ISO_8859_1
and ENC_UTF8. The supported encodings can be extended by adding
new encoding definitions in include/constats_general.php.
---------------------------------------------------------------------------
Version 3.0.5 (beta), 2011-02-10
- Fixed javascript compatibility issue related to Internet Explorer
in reports admin.
- Fixed spelling error in german language translation
- Fixed problem with german special characters (Umlaute) in Form captions.
Some admin panels did not work properly because of this issue.
- Filters were ignored in chart generation if the according filter fields
were not included in the chart data.
- The auto-increment value of the ID field is now resetted if all data
is cleared using the mysql logstream maintenance functions.
---------------------------------------------------------------------------
Version 3.0.4 (beta), 2010-11-16
- Fixed Copy and Paste error in db_template.txt.
---------------------------------------------------------------------------
Version 3.0.3 (beta), 2010-10-28
- Added support for using custom filter for charts, for example if you
want to create charts for single servers.
- Added support for using custom default filters in logstream sources.
This filter will always prepended for all other custom search filters.
- Added new UserDB fields and updated database version to 10
---------------------------------------------------------------------------
Version 3.0.2 (beta), 2010-10-22
- Added support to use a proxy server for internal url request. For
example the update check request which is done during login
will use this proxy server if configured.
- Fixed TYPO in maintenance.sh, the parameter is cleandata, not cleardata.
- Added favicon which was submitted by Chris Hartman.
---------------------------------------------------------------------------
Version 3.0.1 (beta), 2010-04-14
- Fixed record height issue when "Show Onlinesearch icons within fields"
option was enabled
- Added support to automatically add missing fields in Mysql and PDO
Logstreams. Currently MySQL and PostgreSQL are support only.
- Error details of logstream sources will now be shown on detail.php
page as well.
---------------------------------------------------------------------------
Version 3.0.0 (beta), 2010-03-29
- All references to phpLogCon have now been renamed to LogAnalyzer,
which will be the new name for the phpLogCon project from now on.
- Added initial implementation of the new Report engine along with
two free reports called "EventLog Summary" and "Syslog Summary"
- Autoreload time in admin panels is now configureable.
- Added Read-Only User functionality.
- Added Updatecheck functionality for future update notifications.
- Fixed alignment of formfields in all admin panels.
---------------------------------------------------------------------------
Version 2.8.1 (v2-stable), 2010-02-23
- Added Inline searchicon, will be visible in each online
searchable field. Can be disabled in admin center.
- Added Updatecheck which will be performed during login only, so once per
session. If a newer Version is available, you will be notified in
Admin Center.
- Secured Views, Sources, Searches and Charts Admin access from users
without admin access.
- Settings will be remembered now when configuring columns in Views
Admin Panel.
- Normal users cannot init or remove message parsers anymore
- Added Time-extension on search page (send by Sergey Sireskin).
---------------------------------------------------------------------------
Version 2.9.0 (beta), 2010-01-14
- Merged previous devel branch into Stable branch and set
new version number 2.9
---------------------------------------------------------------------------
Version 2.8.0 (v2-stable), 2010-01-14
- Merged previous Beta branch into Stable branch and set
new version number 2.8
- As of RFC5424, changed ProcessID Field into string valuetype, which has
effect on how searches are done.
---------------------------------------------------------------------------
Version 2.7.3 (beta), 2009-11-17
- Merged bugfixes and changes from 2.6.5 stable into beta branch
---------------------------------------------------------------------------
Version 2.6.5 (v2-stable), 2009-11-17
- Fixed wrong include in maintenance.php which caused the script to fail
---------------------------------------------------------------------------
Version 2.7.2 (beta), 2009-08-17
- Merged bugfixes and changes from 2.6.4 stable into beta branch
---------------------------------------------------------------------------
Version 2.6.4 (v2-stable), 2009-08-14
- Removed unneeded call for define_syslog_variables, which is
depreceated in php 5.3 and will be removed in php6
- Replaced SPLIT call in install.php with preg_split because SPLIT
is a depreceated function and will proberly be removed in php6
- Updated jpgraph classes to version 3.0.2 which also removes some
issues with depreaced functions in php 5.3
---------------------------------------------------------------------------
Version 2.7.1 (beta), 2009-05-06
- Merged bugfixes from 2.6.3 stable into beta branch
---------------------------------------------------------------------------
Version 2.6.3 (v2-stable), 2009-04-29
- Fixed a bug that caused fields like syslog facily, severity or
messagetype to be shown numeric instead of readable
coloured replacements.
- Fixed a bug in the detail page which could cause numeric fields
to be missing.
- Added support for debug output in the data cleanup routine of
mysql and pdo logstreams. This will help troubleshooting.
---------------------------------------------------------------------------
Version 2.7.0 (beta), 2009-03-26
- Added support for dynamic filenames in disk logstream by using
replacement characters. See the doc for details.
- Added support for using REGEXP on supported logstream sources. Currently
MYSQL and PostGRESQL are supported due the native support of REGEXP. To
use REGEXP in searches, prepend the search phrase with the ~ character.
- Added support for configuring and administrating custom database
mappings in the Admin Center. This makes it easier to
support custom table layouts.
---------------------------------------------------------------------------
Version 2.6.2 (v2-stable), 2009-03-24
- Fixed minor spelling errors in language files (BugID #115)
- Fixed number of records exported when using the export (BugID #110).
- Added missing filter selection for message type filter on search page.
- Fixed Filtering issues when using multiple filters on the same field.
Numeric based filters will now work as expected again (BugID #108).
- Fixed table detection method in PDO LogStream.
- Added support to parse date only values like "2009-03-24".
---------------------------------------------------------------------------
Version 2.6.1 (v2-stable), 2009-03-23
- Fixed an issue with case sensitive fieldnames in db and pdo logstream.
This issue could cause unexpected results depending on how fieldnames
were returned by the database layer. Now, all fieldnames and array keys
are automatically converted into lowercase.
- Fixed minor database template definition issues with the logcon_config
table, the propvalue and propvalue_text field can be NULL now.
---------------------------------------------------------------------------
Version 2.6.0 (v2-stable), 2009-03-20
- Merged beta branch into v2-stable branch.
---------------------------------------------------------------------------
Version 2.5.24 (beta), 2009-01-27
- Added italian language files, translated by Luigi Rosa
- Improved loading of language files, to avoid display error's if
translation is incomplete.
- Enhanced database performance of MYSQL and PDO logstream source drivers.
Searching and paging through results is much faster on larger
databases now.
- Enhanced Pager performance on index and detail page.
- Hardened db logstream classes against invalid parameters.
- Added missing include file for debug functions
- Debug Messages are now printed well formated below the site content
- Improved Documentation
---------------------------------------------------------------------------
Version 2.5.23 (beta), 2008-12-23
- Fixed typo in textual month detection, which caused date detection
problems in december month only.
- Fixed missing include of debug functions in maintenance.php
- Added some performance tweaks into mysql db driver, which will make
searching for strings within messages faster.
---------------------------------------------------------------------------
Version 2.5.22 (beta), 2008-12-10
- Added workaround for year detection for RFC 3164 like timestamps.
This also resolves issues of the syslog date detection on new year.
- Fixed a notice error in chartgenerator, only visible if debug
options were enabled.
---------------------------------------------------------------------------
Version 2.5.21 (beta), 2008-11-24
- Fixed an infinite search loop which occured of the option
"Suppress Duplicated Messages was enabled". This caused the index page
to timeout once a duplicated message was hit.
- Fixed that filters were ignored when exporting results to cvs/xml
---------------------------------------------------------------------------
Version 2.5.20 (beta), 2008-11-19
- Fixed a performance issue in the logstream db and pdo drivers when
using filters. This bug could cause script timeouts when using complex
filters.
- Added default .htaccess to prevent webserver access on cron folder
---------------------------------------------------------------------------
Version 2.5.19 (beta), 2008-11-18
- Added a new "cron" folder which contains a maintenance.php script.
This script can be used on command line level for database maintenance.
For more information, see the documentation.
- Fixed typo of new column "DBRecordsPerQuery" in admin/sources.php
which caused an error when adding new database logstream sources.
---------------------------------------------------------------------------
Version 2.5.18 (beta), 2008-11-12
- Added logstream statistic and maintenance option which are accessable
in the sources admin panel. You can view overall stats of database
logstreams, and cleanup data based on the date field.
- Added option to use a custom phpLogCon logo in the header.
The logo url can be configured in the admin panel
---------------------------------------------------------------------------
Version 2.5.17 (beta), 2008-11-03
- Fixed default database template, updates for DB Version 6 and 7 were
missing.
- Added expandable submenu for help into the top menu. Also fixed some
minor stylesheet issues, to optimize usebility in the main view.
- The detail page hides empty fields now.
---------------------------------------------------------------------------
Version 2.5.16 (beta), 2008-10-27
- Fixed a problem when adding a mysql logstream source. Due a problem of
how php mysql_connect function handels second conenctions, the Verify
of a newly added logstream source could cause the first database
connection to be overwritten. The following error is, that the wrong
database was used for the UserDB after the new logstream was verified.
- Added a check into the redirect function to STOP redirecting if an
error happens in the UserDB.
- Fixed minor issues handling form input which happened when
magic_quotes_gpc was enabled.
- Fixed a bug in the convert.php script which inserted the wrong
database version number. This caused phpLogCon to force an database
upgrade which is not needed at all.
- Added dummy db update scripts, so the db upgrade script won't fail
in future. This is for the case when the db version is not correctly
or missing in the user database.
- Added support to filter for dynamic fields within the logstream
database sources. This was not possible yet. The filtering also has a
secure end timer, which avoids that the timelimit hits the script.
- Added support to suppress unparseable messages when using msgparsers.
This enhances useability if you have mixed data sources, and want to
filter out unparseable messages.
- Added new setting for MYSQL logstream sources to control the amount
of data per query. This value can be used to tweak the MYSQL
performance. For example when filtering for fields which are generated
by a message parser, highering the value does improve the database
performance. The default value is 100, and should only be changed if
you know what you are doing.
---------------------------------------------------------------------------
Version 2.5.15 (beta), 2008-10-22
- Corrected the check for magic_quotes_gpc which is important when saving
configuration values are saved into the UserDB. This also fixes a
problem of duplicating backslahes when using \ or ' in string fields.
- Fixed a minor bug of handling and saving the ViewEntriesPerPage option.
- Added Option to inject custom html code into the header and footer.
- Added Help Links into the message parser admin panel.
- Cleaned up and enhanced the default and dark theme.
- Improved documentation
---------------------------------------------------------------------------
Version 2.5.14 (beta), 2008-10-10
- Added support for fully customizeable fields. This includes a fields
admin with possibility to customize width and alignment of fields,
and add new custom ones.
- Added new table into user database to support the custom fields. This
requires a database upgrade.
- Add admin panel for message parsers. This includes further information
on the parsers as well as the option to import necessary custom fields
for the message parsers.
- Overall simplified code related to field definitions and types.
---------------------------------------------------------------------------
Version 2.5.13 (beta), 2008-10-07
- Improved documentation, added general and search description.
- The conversion script does convert the charts now as well.
- Added global warning which will be displayed on all pages if a
database update is pending
- Added button below searchfield which becomes visible when
you run searches which links to the asktheoracle site.
- Fixed a race condition in the installer which could cause phpLogCon
to fail at Step 8.
- Added parser for apache2 common format. So we support apache combine
and common now.
---------------------------------------------------------------------------
Version 2.5.12 (beta), 2008-09-29
- Fixed several SQL issues in the logstream classes when filtering
was used.
- Enhanced all content menus in the main site, reduced coding as well.
- Added support for URL detection within the data of string fields, these
links can be opened in new windows.
- Fixed bug when excluding more then one string filter from the
same field type.
- Fixed wrong database version insert in install.php as well as
incorrect redirect login page during install.
---------------------------------------------------------------------------
Version 2.5.11 (beta), 2008-09-25
- Fixed the "next page" button when a logstream disk source was used.
The "next page" button stopped working as a side effect of some
performance changes made in the last version.
- Added new description field for logstream sources. If the description
field is used, the description is shown below the pager on the
main index site. The database version has also been incremented, this
only affects you if you are using the user system.
---------------------------------------------------------------------------
Version 2.5.10 (beta), 2008-09-24
- Merged devel branch into beta branch.
- Enhanced search performance in disk logstream, specially when searching
in large files.
- Enhanced critical error display, and added better error details if the
user db server is not reachable
---------------------------------------------------------------------------
Version 2.4.0 (v2-stable), 2008-09-24
- Merged beta branch into v2-stable branch.
---------------------------------------------------------------------------
Version 2.5.9 (devel), 2008-09-19
- Implemented support to analyze Webserver logfiles from Apache and
Microsoft IIS Webserver. There is a collection of new fields available,
filtering is possible. . In order to read Apache or IIS logfiles,
you need to use the "iis" or "apache2" message parser in your disk
sources.
- Added a new page called "asktheoracle.php" which will be automatically
linked on IP's and domain names. It is a simple helper page which
creates a bunch of usefull filter links.
- Added some basic documentation into the doc folder. phpLogCon
does also link to this documentation now (Help Menu Entry).
- Added a general option to limit the display of string fields.
- Added a general option to configure the timeout value of popup menus.
- Added a general option to alter the php scrip timeout. This is of course
only possible if the php interpreter is allowed to change the script
timeout.
- Added checks for the script timeout in the disk logstream, this avoids
that the script is suddenly stopped by the php interpreter.
- Fixed a sorting bug in the disk logstream, which removed numeric
values in the charts
- Added support to filter for a + character as well now. In order to filter
for strings containing the + character, just add replace it with ++.
A single + will still be equal to a space character in the filter engine.
---------------------------------------------------------------------------
Version 2.5.8 (devel), 2008-09-16
- Added Bitstream Vera Fonts into the package which will be used by the
chart generator. So there won't be a problem of missing truetype fonts
anymore.
- Tweaked the visual appereance of all chart types.
---------------------------------------------------------------------------
Version 2.5.7 (devel), 2008-09-15
- Added Statistics page for chart generation. The following charts are
possible right now: Pie, bars vertical and bars horicontal.
All charts can be configured within the Admin Center, if the user system
is installed and enabled. Custom charts can be added as well.
- Added filter / search support for processid, event category and the
event user field
- Added database update, as we now have a new table to store
configured charts into.
- Fixed a few minor filtering issues, specially with numeric filters.
---------------------------------------------------------------------------
Version 2.3.11 (beta), 2008-09-08
- Fix another parsing issue in the logline parser. Most of RFC 3164
formatted syslog messages should now be correctly splitted into their
fields.
---------------------------------------------------------------------------
Version 2.5.6 (devel), 2008-09-03
- Implemented Message Parser facility. This new extendable facility of
phpLogCon helps splitting messages into fields. And the fields can
be filtered and searched for, this expands the full potential of
phpLogCon. A message parser for windows eventlog logfiles generated
by Adiscon products is included.
- Linebreaks within messages are now displayed in the popup window,
and the detail page.
- Added Database Upgrade functionalety, the reason is simple, because
there was an update to the database structure. If you are using the
User Management system, you will be prompted to upgrade your database
next time you login.
---------------------------------------------------------------------------
Version 2.5.5 (devel), 2008-08-28
- Added option to send debug messages (warnings and error's) from
phpLogCon to the local syslog server on linux. On Windows, the debug
messages will appear in the application event log.
- Enhanced the PDO Logstream Driver for better performance on large
databases. On MYSQL and POSTGRES, the PDO Logstream does not uses the
LIMIT statement to minimize database usage.
---------------------------------------------------------------------------
Version 2.3.10 (beta), 2008-08-27
- Fixed a few parsing issues with prior RFC 3164 syslog messages.
These messages are now correctly parsed, or better do not cause
any parsing problems anymore.
---------------------------------------------------------------------------
Version 2.5.4 (devel), 2008-08-05
- Included fixed from Beta v2.3.9
---------------------------------------------------------------------------
Version 2.3.9 (beta), 2008-08-07
- Fixed a bug in the parsing of RFC 3164 date and time stamps which
occured from the 1st to the 9th of each month. During this time, the
date was not correctly parsed.
- Enhanced detail popup window, it performs much better now and is less
annoying. It still can be turned off very easily.
- Fixed an image alignment problem of the message once and for all.
---------------------------------------------------------------------------
Version 2.5.3 (devel), 2008-08-05
- Added support to export the current visible events into a XML or CSV
file. If you have further recommendations for useful export file
formats, just let us know in the phpLogCon forums or mailinglist.
- Extended Filter Engine to support Full and Partial Text searches on
string fields. The submenu buttons also now use the Full Text search
by default, which performs much better on database logstream sources.
- A new menu entry on each value on each field in the main EventView
gives you the option to search for this field only, or extend an
existing filterset.
---------------------------------------------------------------------------
Version 2.5.2 (devel), 2008-08-01
- General Options are now configureable on user basis, if UserDB System
is installed of course. This means first, phpLogCon used the global
configured options, then the user configured - if available.
- When you add new Sources, the source is checked with better error details.
If you have a database connection, even the existence of the configured
table is checked. This helps locating configuration problems.
- Fixed minor bug in the installer which was added in v2.5.0.
- Fixed spelling errors in the admin index template.
- Error messages in the admin center contain more useful details now.
---------------------------------------------------------------------------
Version 2.5.1 (devel), 2008-07-29
- Added a new option to suppress displaying multiple messages. This
means if you have two or more messages of the exact same text one after
another, only ONE message will be shown. This helps to "compress" the
logview a little bit.
- New feature, added Maximize/Normalize button into the menu. You can
hide the header now by using this feature for maximum log display.
- If the UserDB System is enabled, the donate button will only being
shown within the Admin Center.
- Fixed a bug in the input checking of files when a Diskfile source
was added or reconfigured.
- Fixed minor bug reading the correct default view for sources from DB.
- Fixed a problem in the Views Admin, a set of predefined columns could be
in the list.
- Enhanced error display in all admin templates.
---------------------------------------------------------------------------
Version 2.3.8 (beta), 2008-07-28
- Fixed a "notice" bug in the installer, which was missing to save the
DBType for MYSQL Datasource.
- Fixed a bug in the pdo logstream class which caused display of empty
rows when no records where found.
- Fixed Bug ID82 from bugtracker. Internal and invalid IP Addresses are
not linked to whois anymore.
- Fixed Line Ending to Unix in some code files.
---------------------------------------------------------------------------
Version 2.5.0 (devel), 2008-07-24
- Fully implemented the UserDB System. This is the next major milestone
in the development of phpLogCon. The new UserDB System allows you to
fully customize phpLogCon using an admin interface and offers the
following sub-features: Users, Groups, Sources, Views, Searches and
general options. Exiting configurations can be imported into the
user system using the convert.php script. The installer has an option
to install the user system.
- Added Icons to all Topmenu entries, as well as into the Admin
Topmenu entries.
- Improved stylesheets
---------------------------------------------------------------------------
Version 2.3.7 (beta), 2008-07-07
- Added missing db mapping for program field of syslogng - thanks to
Micha "Wolvverine" Panasiewicz
- Added translation for Brazilian Portuguese, thanks to Ricardo Maraschini
---------------------------------------------------------------------------
Version 2.5.0 (devel), 2008-06-10
- Moved older devel branch to beta branch. Increment Version minor number.
---------------------------------------------------------------------------
Version 2.2.0 (v2-stable), 2008-06-10
- Moved beta branch to v2-stable branch.
---------------------------------------------------------------------------
Version 2.3.6 (devel), 2008-06-09
- Added new feature, multiple configureable views which can be configured
and selected for each source seperately. Old configurations can still
be used with the new Views feature. The installer also supports
selecting the default View for the first added source.
---------------------------------------------------------------------------
Version 2.3.5 (devel), 2008-06-06
- Enhanced the detected of IP Addresses and domain names, so the automatic
generated context links match better now.
- Added new option (enabled by default) to resolve IP Addresses into
hostnames. Note that this will only be done if the IP Address is NOT in
square brackets. The resolved names will be cached in the users session,
to speed up the resolving process. The resolved IP Addresses will be
injected behind the IP Address in curly brackets, and a diffirent colour.
---------------------------------------------------------------------------
Version 2.3.4 (devel), 2008-06-02
- Added new feature to automatically link IP and domain names with our
whois search engine. So you can research these informations with one
click.
- Changed Online Search Parameters. For Eventlog related search links,
you will now directly directed to entries in our knowledge base, if
found.
---------------------------------------------------------------------------
Version 2.3.3 (devel), 2008-05-23
- Initial Added the new DB Driver (Logstream) which uses PHP PDO.
PDO is the latest generic database interface for PHP5 and recommended
for best performance. It is possible to use other database engines with
this new logstream class like mssql, postgres sql, odbc, oracle
or even ibm db2.
- Optimized the logic of the pager and increased performance
related to it.
- Added support for the new Database driver into the installation script.
The old driver has been renamed to MYSQL Native and is also
recommended if you use MYSQL as database server.
---------------------------------------------------------------------------
Version 2.3.2 (devel), 2008-05-20
- Implemented Online Search button into the field submenus. The search
uses our new repository at kb.monitorware.com.
- Added pager to the bottom of the index page as well (bugtracker id 76)
- Added filtering support for the new Eventlog fields
- Adding field mapping definitions for Windows Eventlog which are:
SYSLOG_EVENT_LOGTYPE, SYSLOG_EVENT_SOURCE, SYSLOG_EVENT_CATEGORY,
SYSLOG_EVENT_ID and SYSLOG_EVENT_USER
- Simplified columns configuration definition in config.sample.php
- Fixed minor css issues.
---------------------------------------------------------------------------
Version 2.1.6 (beta), 2008-05-19
- Fixed filter bug, if you want to filter with ":", you can do this by
using "\:" now.
- Added donate button ;)
- Changed install.php handling, so it is not necessary to remove the
script after installation anymore. It is only possible to use
install.php if the config.php is empty or does not exist.
- Added check for installed PHP Version. phpLogCon will refuse to run
on PHP4 or lower from now on!
---------------------------------------------------------------------------
Version 2.3.1 (devel), 2008-05-02
- The page title is now created with Source, and other useful informations.
It is also possible to configure a custom title string with the
configuration, which will be prepended into each phpLogcon page.
- Added support for gzip compression (configurable), this will reduce
bandwidth and page load time.
- Added Auto reload function into main list view, can be enabled by default
in the configuration as well. Done using a META REFRESH.
- Added new configuration variable to set the default SourceID. The source
parameter will be appened to all necessary links and forms within
phplogcon, if the session sources differs from the default one.
Version 2.1.5 (beta), 2008-05-05
- Converted all files into UNIX format (^M has been removed)
---------------------------------------------------------------------------
Version 2.3.0 (devel), 2008-04-30
- Added "Back to Listview" button in the detailview.
- Added filter for message type
- Added inline button menus into the listview. Most values can be clicked
now, which opens a menu with additional useful links.
- Added Pagesite Selection into listview, so you can change the amount of
records you want to see on one page at any time you want.
- greatly improved database performance, runs much better now, but there
is still room for further optimization
---------------------------------------------------------------------------
Version 2.1.4 (beta), 2008-04-29
- Added missing facility 10 to 15 from RFC3164 into phhlogcon
---------------------------------------------------------------------------
Version 2.1.3 (beta), 2008-04-28
- Fixed a bug in the installer, the table type was not written into the
configuration.
Version 2.1.2 (beta), 2008-04-28
---------------------------------------------------------------------------
- Removed syslog sample logfile from samplelogs, fixed minor issue in the
installer
- Fixed bug in logstreamlineparsersyslog.class which failed to parse
some rsyslog loglines.
- Special characters like german "umlaute" are now proberly replaced
- Added link to help page, pointing to rsyslog wiki
- Changed database layout from winsyslog to monitorware.
Added more debug handling
---------------------------------------------------------------------------
Version 2.1.1 (beta), 2008-04-25
- added detail page into phpLogCon. The detail page shows all possible
details of a syslog message. It also possible to page in the
detail view.
- fixed minor notices bugs in the functions_db.php, which is really used
right now. But it will become important once the user-ui will be added.
- fixed "NEXT" button bug in the install script. Infact only ONE next
button is available now in the install script. This removes the
duplicated ones from before.
- added full german translation (thanks to Tom Bergfeld for providing it)
---------------------------------------------------------------------------
Version 2.1.0 (beta), 2008-04-24
- initial release of the rewritten phpLogCon v2
loganalyzer-4.1.5/INSTALL 0000664 0000000 0000000 00000020401 12777402504 0015106 0 ustar 00root root 0000000 0000000
LogAnalyzer Installation help
----------------------------------
To install LogAnalyzer, you will need:
* Apache or IIS Webserver
* PHP5
Optionally, you may need:
* MySQL Database
For obvious reasons, you also need some syslog data. Any standard
syslogd will do. From a feature and stability point of view, we
recommend either one of these (which we also wrote ;)):
- WinSyslog (for Windows Environments - http://www.winsyslog.com)
- rsyslog (for Linux/Unix Environments - http://www.rsyslog.com)
Both of them are also capable to writing to a database. Rsyslog is
a drop-in replacement for stock syslogd and also *is* the stock
syslogd on some platforms (e.g. Fedora 8 and above).
Installation in Detail
----------------------
1. Upload all files from the loganalyzer/src/ folder to you webserver.
The other files are not needed on the webserver.
2. If your webserver has write access to the LogAnalyzer folder,
you can skip the following step:
Upload the scripts configure.sh and secure.sh from the
contrib folder to your webserver, into the same folder
where you uploaded the other LogAnalyzer files into. Then set
the execution flag to them (chmod +x configure.sh secure.sh).
Now run ./configure.sh, this will create a blank config.php,
and will also set write access to everyone to it.
You can of course do this manually if you want.
3. Now open your LogAnalyzer installation in your favourite webbrowser,
you will see an error, and you will be pointed to the installation
script. The install script will guide you through the LogAnalyzer
installation, just follow the instructions.
3.1 Step 1 - Prerequisites Beginning of installation / welcome site
This is the first page of the installation. It just tells
you, that before installing, some file permission have to
be checked. Simply click "Next" to start the process.
3.2 Step 2 - Verify the file permissions
Here you will see, if the config.php can be written or not.
If it cannot be written, you have to repeat the complete
Step 2.
3.3 Step 3 - Basic Configuration
You can set several basic options here.
- Number of syslog messages per page = 50 (default)
This is the number of syslog messages displayed on each page.
You can increase the value (makes LogAnalyzer slower) or decrease
the value (makes it faster).
- Message character limit for the main view = 80 (default)
Set the number of characters per message which will be shown
in the last column of the main view. Full messages can be
reviewed by hovering the mouse over it.
- Show message details popup (default yes) = yes (default)
Here you can set, if you want the small window with the complete
message to pop up if you are hovering over a event with the
cursor. If you choose "No", then you have to click on the
message to see the details.
3.4 Step 4 - not implemented yet
3.5 Step 5 - not implemented yet
3.6 Step 6 - not implemented yet
3.7 Step 7 - Create the first source for syslog messages
This is the most important step. Here, you will configure
your first data source, which holds all your syslog data.
Mainly, you have to choose a "Name of the Source" and a
"Source Type". The name will be displayed later in a drop-down
menu with which you choose your active syslog source. The
"Source Type" can be a file, a MySQL database or the PHP PDO
which supports different database types like mssql, PostgreSQL,
odbc, oracle or even ibm db2.
If you choose the diskfile, you have to provide the following
information:
- Logline Type = Syslog / Rsyslog (default) or Adiscon WinSyslog
This tells LogAnalyzer, how the lines look like. This is
necessary for show the log messages properly.
- Syslog File = /var/log/syslog (default)
This is the position of the logfile in your file system.
If you choose MySQL native as data source, following information
is needed:
- Table Type = monitorware (default)
This is the table layout. Currently, you can use "monitorware"
or "syslogng". For more details see "Note on MySQL Databases"
below.
- Database Host = localhost (default)
This is the host, where the database is located. By default this
is localhost. You can specify any other host if necessary.
- Database Name = loganalyzer (default)
The name of the database you want to use.
- Database Tablename = systemevents (default)
This is the name of the table in which the data is stored. The
default tablename corresponds to the tables created with the
MonitorWare Line of products.
- Database User = user (default)
The username for the database.
- Database Password = not set by default
The password for the username.
- Enable Row Counting = No (default)
If configured to "Yes", the amount of rows in the table will be
counted with every query, giving you the total records for your
search, though having a lot of impact on your system when using
a very large database. If configured to "No", the rows will not
be counted, providing you a lot more performance.
If you choose Database (PDO), the following has to be defined:
- Database Storage Engine = MySQL Server (default)
Choose the engine of the database you are using. The databases
are available: MySQL Server, Microsoft SQL Server, ODBC
Database Connection, PostgreSQL, Oracle Call Interface, IBM
DB2, Firebird/Interbase 6, IBM Informix Dynamic Server,
SQLite 2.
- Table Type = monitorware (default)
This is the table layout. Currently, you can use "monitorware"
or "syslogng". For more details see "Note on MySQL Databases"
below.
- Database Host = localhost (default)
This is the host, where the database is located. By default this
is localhost. You can specify any other host if necessary.
- Database Name = loganalyzer (default)
The name of the database you want to use.
- Database Tablename = systemevents (default)
This is the name of the table in which the data is stored. The
default tablename corresponds to the tables created with the
MonitorWare Line of products.
- Database User = user (default)
The username for the database.
- Database Password = not set by default
The password for the username.
- Enable Row Counting = No (default)
If configured to "Yes", the amount of rows in the table will be
counted with every query, giving you the total records for your
search, though having a lot of impact on your system when using
a very large database. If configured to "No", the rows will not
be counted, providing you a lot more performance.
3.8 Step 8 - Finish
4. If everything went right, you should see syslog messages already
in your LogAnalyzer installation. You can now remove the install.php
script now.
Note on Accesing Files
--------------------------------
In most environments the webserver has only access to the web directory.
If you want to read files e.g. from /var/log/ you have to grant
the necessary permisson to your webserver.
Of course, you always need to make sure that the user the web server
runs under also has the correct file permissions. Be careful when doing
this, you may create a security vulnerability by granting too much
to too many users.
Note on MySQL Databases
--------------------------------
LogAnalyzer does support using a MySQL database as syslog source.
LogAnalyzer supports Adiscon's MonitorWare database schema. The schema
used by php-syslog-ng is also partly supported. That schema, however, is
somewhat inefficient in that it stores facility and severity codes as
textual values. We do not currently convert these values back to their
native format and consequently facility and severity can not be taken
from a php-syslog-ng database.
loganalyzer-4.1.5/contrib/ 0000775 0000000 0000000 00000000000 12777402504 0015520 5 ustar 00root root 0000000 0000000 loganalyzer-4.1.5/contrib/configure.sh 0000664 0000000 0000000 00000000061 12777402504 0020032 0 ustar 00root root 0000000 0000000 #!/bin/sh
touch config.php
chmod 666 config.php
loganalyzer-4.1.5/contrib/secure.sh 0000664 0000000 0000000 00000000037 12777402504 0017342 0 ustar 00root root 0000000 0000000 #!/bin/sh
chmod 644 config.php
loganalyzer-4.1.5/doc/ 0000775 0000000 0000000 00000000000 12777402504 0014625 5 ustar 00root root 0000000 0000000 loganalyzer-4.1.5/doc/basics.html 0000664 0000000 0000000 00000026005 12777402504 0016762 0 ustar 00root root 0000000 0000000
LogAnalyzer Basics
LogAnalyzer Basics
This documentation describes some basic concepts of LogAnalyzer. It
is meant as a useful guide for understanding concepts, the application itself
as well as the rest of the documentation.
Configuring LogAnalyzer
LogAnalyzer is configured via a master configuration file. If the userDB system
(see below) is enabled, most settings can be made via the web-application itself
without any further need to change the config file.
Intial configuration can also be done during a setup wizard, which writes
an initial configuration file itself. This wizard can also enable the userDB system,
so in this case you probably never need to touch the configuration file.
Data Sources
A data source is a set of syslog (and other) data that is gathered. Data sources
can be text files or databases. Any text file is supported, as long as it contains
purely printable characters and LF is used as a line terminator. This applies to
all regular text files so in short you can use whatver is present in text format.
Obviously, these are files written by the syslogd, but this also includes any
other text file, e.g. written by an application as its log file. Note that at
this time, a file data source can contain exactly one file (and NOT multiple).
For the database, tabels in either MonitorWare format or the format used by
php-syslog-ng is supported. We support php-syslog-ng schema mainly for migration
scenarios: it is sub-optimal in that it uses text strings where integer values are sufficient.
This results in the need for more database space plus slower response time. If
you set up something new, be sure the use MonitorWare schema. If you use
rsyslog to create the database, please note
that rsyslog uses MonitorWare schema by default, too. So you probably need not to
do anything special.
Searches
With LogAnalyzer, you can search any datasource for a variety of properties.
By default, text is searched within the msg part of the message. However, quite
complex searches can be performed. It is suggested to use the "advanced search"
button to build these. Alternatively, you can also review the
"LogAnalyzer search syntax" documentation to see how
to craft complex searches manually.
Note that searches are done via http get requests. That
means you can copy and paste an url (or bookmark and email it) and that URL
will contain a complete source. This is actually a great way to send searches
to a co-worker or have some automatted process (eg via cron " wget) pull specific
data on a periodic schedule.
The search part of LogAnalyzer is used much like any major search engine
and hopefully is quite intuitive.
Note that a search is currently limited to a single data source only. If you
would like to search across different data sources, you need to do this on the basis
of individual data sources. To support you at least a bit in the process, there
is a special page (for historical reasons called "the Oracle") which generates canned
searches for you, so that you only need to click the individual search links to perform
these searches. We know this is not perfect, but we hope this is useful.
Context Links and Menues
At appropriate places, LogAnalyzer generates context links to potentially helpful
information. For example, links to domain or IP range owner lookup or troubleshooting
information (via the external knowledge base)
are generated. At other places, links to the cross-datasource search capability are
generated.
Consider this example to understand why it is done and how it may be useful. Let's
assume you have two data sources, one with your firewall log and one with the mail log.
Now you wonder why a recent spam attack could happen. You review the mail log and find
indication of the spammer. Now, you can lookup the IP addresses and domain names used.
Probably more interesting, you can invoke the cross-datasource search tool and obtain
information on what the firewall log has recorded about the IPs in question. Finally,
you may want to check the online knowledge based if there is some information
recorded about this or a similar event (for example, if you found a message that
puzzels you). You may even ask you peers for help via the knowledge base.
In addition to the links, there are helpful popup menues for most of the
properties being displayed. To find out what you can do, please simply click the values
(even those that do NOT look like a link) and see what the popup has to offer (and, yes,
we will improve doc on these topics... ;)).
Windows Event Log Data
LogAnalyzer contains automatic support for displaying Windows Event Log data
in a useful format if that data is generated by either the
EventReporter
or the
MonitorWare Agent
forwarding agents. This includes proper detection, and ability to filter, on
event-log specific properties (like Windows event id and such).
The UserDB System
The so-called userDB system allows different user accounts to be created and
user-specific settings to be made. This is a great aid if multiple people share
a single instance of LogAnalyzer.
The userDB system is disabled by default. This is because
a database is needed for the userDB system as user profiles are stored
inside it. Setting up the database tables requires some additonal work,
so we do not expect users to do this by default. Please do not confuse this with
database (log) data sources: these are not necessarily needed. You can use
the userDB system and still store the log data in text files (which may be
desirable from a performance point of view). To enable the userDB system,
the LogAnalyzer configuration file needs to be changed. Note that once the
userDB system is active, most system settings can be made via the web application.
There are basically two types of users: admins and non-admins. Admins can
change anything, non-admins can only change their personal preferences.
The userDB system is not yet a strong security tool, but helps greatly with
moderate security needs. User groups can be created and data sources be assigned
to a specific user group. So only users of this group can access the data
source in question. This is useful if you have a group of people caring about
the firewall logs and another group caring about the mail logs. You can then define
two different groups and assign the data source accordingly. Then, assign the
user's the group they should belong to. The end result is that every user only
sees what he or she is expected to see.
Do I need a Database?
Not necessarily. LogAnalyzer only needs databases if you plan to use
the userDB system or use database data sources. Without that, no database is
needed. A typical scenario, for example, is private review of server-based
syslog files. For this use case, no database is required.
Securing LogAnalyzer
Log data is very valuable to an attacker. So it is highly suggested that you
secure access to any LogAnalyzer instance, especially if it contains live log
data. We suggest to place it on local, non-internet accessible servers, only.
In a hosting environment, it may be useful to place it on an internet-accessible
server. In this case, access should be protected on the http layer at least.
In any case, the use of https is suggested to prevent accidental loss
of confidentiality (this is important in the local network, too!).
The userDB system can be used as a tool to tune user's ability to
view data sources (users can only view those sources that belong to
one of their groups). However, this is currently considered a secondary access
control mechanism. An Internet-accessible instance of LogAnalyzer should
NOT rely on that as the sole source of protection.
Please note that this section gives just a few rough, common-sense
recommendations. Evaluate the risk yourself, check with your policies and
do not blame us if you made a mistake ;) In short: use LogAnalyzer at your
sole risk, and reduce this risk by thinking about what you do.
You may consider to purchase
professional services
if you are serious about the risk implications in an (enterprise) environment.
External Tool Integration
As already described, LogAnalyzer accesses external tools, most importantly the
MonitorWare Knowledge Base to aid you
in your analysis effort. The goal is to provide useful information that helps
you get the job done better and quicker.
No private data (except the obious one, eg a domain name for a domain search)
is provided to the external entity nor is anything recorded (except for what
can be seen from regular web logs). However, you need to decide yourself, as with
all external accesses, if this functionality fits into your security policy.
Please note that the external tool is able to call back into your local
LogAnalyzer installation if you provide it with the local URL. This can be done via
the user profile in the external part. Note that both the local as well as
the external part are programmed in such a way that no private data (except
for the URL) needs to be kept externally and, most important, local data
is never visible to a third-party observer. The notable exception is if you
host your local LogAnalyzer on an external server without any further security
measure (e.g. https, access restrictions). Even in that case the external
part will not be able to access data from the local part, but an attacker
may find it easy to get hold of your log data (which is always the case
with such a local setup and not specifically related to the local/external integration).
Upgrades
LogAnalyzer is actively being developed. So chances are good you want to
upgrade to a later release at some time. In general, it is always a good idea
to backup everything before you upgrade. We highly recommend doing so. Other than that,
the upgrade should be fairly easy without the installed userDB system. If the
userDB system is installed, it may be necessary to upgrade the database schema. This
can be done via the admin center. No access to LogAnalyzer is possible unless the
database schema has been upgraded.
Again, as a general precaution, you should have a solid backup available
before you run the upgrade procedure (and this specifically applies to any
database content!).
[manual index] [LogAnalyzer site]
This documentation is part of the
Adiscon LogAnalyzer project.
Copyright © 2008-2011 by Adiscon.
Released under the GNU GPL version 3 or higher.
Adiscon LogAnaylzer commercial licenses are also available.
loganalyzer-4.1.5/doc/build_from_repo.html 0000664 0000000 0000000 00000004560 12777402504 0020667 0 ustar 00root root 0000000 0000000
Installing LogAnalyzer from the source repository
Installing LogAnalyzer from the source repository
In most cases, people install LogAnalyzer either via a package or use an "official"
distribution tarball to generate it. But there may be situations where it is desirable
to install directly from the source repository. This is useful for people who would like to
participate in development or who would like to use the latest, not-yet-released code.
The later may especially be the case if you are asked to try out an experimental version.
Installing from the repsitory is not much different than building from the source
tarball, except that you need to know how to obtain things.
Obtaining the Source
You need to download the sources. LogAnalyzer is currently kept in a git
repository. You can clone this repository either via http or git protocol (with the later
being much faster. URLS are:
- git://git.adiscon.com/git/phplogcon.git
- http://git.adiscon.com/git/phplogcon.git
There is also a browsable version (gitweb) available at
http://git.adiscon.com/?p=phplogcon.git;a=summary.
This version also offers snapshots of each commit for easy download. You can use these if
you do not have git present on your system.
After you have cloned the repository, you are in the master branch by default. This
is where we keep the devel branch. If you need any other branch, you need to do
a "git checkout --track -b branch origin/branch". For example, the command to check out
the beta branch is "git checkout --track -b beta origin/beta".
Actual Install Process
The actual installation does not differ from a version obtained via
a tarball. Please see the
LogAnalyzer install guide for details on how to do that.
[manual index] [LogAnalyzer site]
This documentation is part of the
Adiscon LogAnalyzer project.
Copyright © 2008-2011 by Adiscon.
Released under the GNU GPL version 3 or higher.
Adiscon LogAnaylzer commercial licenses are also available.
loganalyzer-4.1.5/doc/devel/ 0000775 0000000 0000000 00000000000 12777402504 0015724 5 ustar 00root root 0000000 0000000 loganalyzer-4.1.5/doc/devel/Activity.dia 0000664 0000000 0000000 00000011376 12777402504 0020207 0 ustar 00root root 0000000 0000000 ]sF_A9/*e3DM%Nnnх%,sA^~3,blkUcD0ӿ~aGi#
Y:śOw۳QȂ%>7EyP5Ëq\Eo,Am~E]Je:u2?/Wm8ͬAu~E:{
u__ҫ0۽rXRܯjKZ#dfU.%D)oik5h+bd(&.A!D<{)xr㒋%K.ʯViVdATI^iIIa:,ǖ7QQ&.ޞcO"neEUyq{*~o<æbsݷ5wCyVx{!XG0?ͪkZtYvq`_퀵"aϏ0mm^FbHar$;Ri6pxą^@uD l%PP@QGW^;N58>(0Ataڽ>3ĉ)#aD M:@v[!z
ݛ F\). х
.%I+ĉ FkԢP0DΠn@Éxq5
cHEܴmISsP~p->jEvzD*j8tfA!1R!LU#{}udIf{rwY2ύ܈y5
js+8iO
q2ɢ.=Ce\F,U
oէͫ.OsD 5e<$i
.$W,¬1Z̤JД)poyLf7iTǦ eazLuq 7e;6K/{^{/ڇ[w4id9yә6+Jn,*d^LJH x_﮵D&/X^/>;> ?@~ q̘H#?~) A@v
h` "iL](gn4Y."^u#z|PR R R R R R |X ; ):.4Av HoNAv XRAt 'e$*@z x =@z@LwiVYCm&huvO1Fh%98R4H3^igD{32w_1=EI! lOl~,bFrVG
!