Subversion Repositories ALCASAR

Compare Revisions

No changes between revisions

Ignore whitespace Rev 1247 → Rev 1246

/scripts/alcasar-archive.sh
54,13 → 54,10
 
function archive() {
mkdir -p $DIR_ARCHIVE
mkdir -p $DIR_TMP
mv $(echo $(ls -rt $DIR_LOG/firewall/tracability.log*.gz | tail -n 1 -)) $DIR_TMP/tracability-HTTP.log-$NOW.gz
mv $(echo $(ls -rt $DIR_BASE/radius-*.sql | tail -n 1 -)) $DIR_TMP/
cd /var/log/nfsen/profiles-data/live/ipt_netflow
find . -mtime 0 -mtime -7 -name 'nfcapd.[0-9]*' | xargs tar -cf $DIR_TMP/tracability-ALL.log-$NOW.tar;
cd /tmp/
tar cvzf /tmp/$FILE archive-$NOW/*
mkdir -p $DIR_TMP
cp $(echo $(ls -rt $DIR_LOG/firewall/tracability.log*.gz | tail -n 1 -)) $DIR_TMP/
cp $(echo $(ls -rt $DIR_BASE/radius-*.sql | tail -n 1 -)) $DIR_TMP/
tar cvzf /tmp/$FILE $DIR_TMP/*
} # end archive
 
# Core script
95,16 → 92,6
rm -rf /tmp/archive-*
chown root:apache $DIR_ARCHIVE/*
;;
--live | -l)
mkdir -p /tmp/live
gap=$(($(date +%d)-1))
cd /var/log/nfsen/profiles-data/live/ipt_netflow
find . -mtime 0 -mtime -$gap -name 'nfcapd.[0-9]*' | xargs tar -cf /tmp/live/tracability.log-$NOW.tar;
cp $(echo $(ls -rt $DIR_BASE/radius-*.sql | tail -n 1 -)) /tmp/live/
cp /var/log/firewall/tracability.log /tmp/live/
tar -czf $DIR_ARCHIVE/tracability-$NOW.tar.gz /tmp/live/*
rm -rf /tmp/live
;;
--update | -u)
# Mise à niveau de l'architecture d'export/archivage
[ -d /tmp/save ] || mkdir -p /tmp/save
/scripts/alcasar-log.sh
0,0 → 1,79
#!/bin/bash
# $Id$
 
# alcasar-log-export.sh
# by Franck BOUIJOUX and REXY
# This script is distributed under the Gnu General Public License (GPL)
 
# Script permettant
# - d'exporter des logs des répertoires /var/log/{squid-firewall-httpd} à des fins d'archivages.
# - Une fonction de chiffrement des logs a été implémentée dans ce script. Lisez la documentation d'exploitation pour l'activer.
# - nettoyage des archives supérieures à 1 an (365 jours)
 
# This script allows
# - export log files from folders /var/log/{squid-firewall-httpd} in order to archive them.
# - a cypher fonction allows to protect these files. Read the exploit documentation to enable it.
# - delete backup files older than one year (365 days)
 
TO_SAVE="/var/Save/logs" # répertoire accessible par webs
REP_SAVE="/var/log" # répertoire local des log
REP_SERVICE="squid httpd firewall" # répertoires contenant des logs utiles à exporter
REP_BASE="/var/Save/base" # répertoire de sauvegarde de la base de données usagers
NOW="$(date +%G%m%d-%Hh%M)" # date et heure du moment
DELAY=365 # Nbre de jour avant suppression des fichiers journaux
CHIFFREMENT="0" # chiffrement des logs ( 0=non / 1=oui )
GPG_USER="" # utilisateur autorisé à déchiffrer les logs. Son biclé est inclus dans le portefeuille gnupg de root (/root/.gnupg)
 
usage="Usage: alcasar-log.sh {--clean or -clean} | {--export or -export} | {--live_export or -live_export}"
 
nb_args=$#
args=$1
if [ $nb_args -eq 0 ]
then
nb_args=1
args="-h"
fi
case $args in
-\? | -h* | --h*)
echo "$usage"
exit 0
;;
--clean|-clean)
for i in $TO_SAVE $REP_SAVE ; do
for j in $REP_SERVICE ; do
cd $i/$j
find . \( -mtime +$DELAY \) -a \( -name '*.gz' -o -name '*.sql' -o -name '' -o -name 'gpg' \) -exec rm -f {} \;
done
done
cd $REP_BASE
find . \( -mtime +$DELAY \) -a \( -name '*.gz' -o -name '*.sql' -o -name '' -o -name 'gpg' \) -exec rm -f {} \;
;;
--export|-export)
for i in $REP_SERVICE ; do
[ -d $TO_SAVE/$i ] || mkdir -p $TO_SAVE/$i # utile une seule fois mais crée le répertoire si nécessaire
cd $REP_SAVE/$i
if [ $CHIFFREMENT -eq "1" ]
then
# chiffrement des logs dans /var/Save/logs/(squid|firewall|httpd)
find . \( -mtime -7 -o -ctime 0 \) -a \( -name '*log-*.gz' \) -exec gpg --output $TO_SAVE/$i/{}.gpg --encrypt --recipient $GPG_USER {} \;
else
# copie simple des logs dans /var/Save/logs/(squid|firewall|httpd)
find . \( -mtime -7 -o -ctime 0 \) -a \( -name '*log-*.gz' \) -exec cp {} $TO_SAVE/$i/. \;
fi
done
chown -R apache.apache $TO_SAVE
;;
--live_export|-live_export)
cp $REP_SAVE/firewall/tracability.log $TO_SAVE/firewall/
gzip $TO_SAVE/firewall/tracability.log
mv $TO_SAVE/firewall/tracability.log.gz $TO_SAVE/firewall/tracability.log-$NOW.gz
chown apache:apache $TO_SAVE/firewall/tracability.log-$NOW.gz
;;
*)
echo "Unknown argument :$1";
echo "$usage"
exit 1
;;
esac
exit 0
 
Property changes:
Added: svn:eol-style
+LF
\ No newline at end of property
Added: svn:executable
+*
\ No newline at end of property
Added: svn:keywords
+Id Author Date
\ No newline at end of property