Comments on: Syslog event generator with Net::RawIP (perl)

By: Chris

Chris — Wed, 10 Dec 2014 08:45:56 +0000

In reply to Ben. Packet.pm goes under Packet, and in there have a directory UDP in which udp.pm goes, and in there a directory called syslog in which you put Syslog.pm. Easiest thing to do is have /Packet in the same directory as your perl script unless you end up better packaging your code

By: Ben

Ben — Tue, 07 Jan 2014 22:38:16 +0000

I’m not quite clear of the filenames and directory structure that the 2nd & 3rd pieces of code should be saved in. Can you elaborate on that, or give more specifics?

By: Sunil

Sunil — Mon, 18 Mar 2013 09:51:45 +0000

Hi Johnny,

I want to change my source IP from where syslog packet is being send e.g. ip address of my machine is 192.168.0.10 which is getting identified as ‘log source’ ip, instead of that I want 10.10.0.12 as a source IP, how to do that, please help.

Thanks
Sunil

By: Chris

Chris — Sat, 09 Mar 2013 20:28:27 +0000

Actually, it does work it just seems to be acting as padding, a space does the same job without the strange hex codes.

By: Chris

Chris — Sat, 09 Mar 2013 20:23:27 +0000

Yep \@udp_fields and \@ip_fields should be in UDP.pm

However, what on earth is � in Syslog.pm? Without it, it doesnt send. With it you get \xEF\xBF on the end of the message?

–Chris

By: Michael Fread

Michael Fread — Tue, 25 Sep 2012 20:28:44 +0000

In reply to Johnny Morano. I got these errors as well. The problem is that all the \ characters are missing in the UDP.pm code listing.

By: Johnny Morano

Johnny Morano — Thu, 12 Jul 2012 12:25:00 +0000

In reply to blaxthos. Hi, How does your 'syslog_gen.pl' script look like?

By: blaxthos

blaxthos — Mon, 09 Jul 2012 15:38:20 +0000

This is great stuff, however... when I attempt to run the script as presented above, I receive the following error:

dev@ubuntu:~/Documents/syslog_generator$ ./syslog_gen.pl 
Odd number of elements in anonymous hash at UDP.pm line 59.
Can't use string ("source") as an ARRAY ref while "strict refs" in use at /usr/local/lib/perl/5.14.2/Net/RawIP.pm line 564.

I've tried turning off strict, but still couldn't get it working. Line 59 in UDP.pm: my(@udp_data) = $self->{rawip}->get({ udp => @udp_fields }); Line 564 in RawIP.pm: map { ${$$hash{"$self->{proto}h"}}{$_} = '$' } @{$hash->{$self->{proto}}}; Perl 5.14.2. Any ideas? Thanks! /b PS - running all with elevated permissions, just in case you need root to access Raw IP.

By: Johnny Morano

Johnny Morano — Thu, 16 Feb 2012 08:48:45 +0000

In reply to Pierre. If you need help, I'm happy to assist ;-)

By: Pierre

Pierre — Wed, 08 Feb 2012 08:53:46 +0000

Hi Johnny

wow, this is really cool. I know very little about perl and scripting, but I am faced with a problem whereby I am recieving a sh#tload of syslog messages from Cisco devices. They are all received by a CiscoWorks LMS server , they are then filtered and then forwarded to an another syslog collecting server. Thing is, that this collecting server “sees” all these messages coming from one device – which is the LMS server. I hope to use your script and modify this forwarding script so that it will show the original devices’ IP address.
Cheers
P