Setting up a Lire responder (Log Analyzer)

Jurjen Bokma

March 2009


Many log analyzers are listed at loganalysis.org. Lire is one such log analyzer. It can be set up in such a way that other machines send their logs for analysis to a machine that has Lire watch incoming mail, the so called responder, and it mails the analysis to the admin. We followed the responder installation manual using Ubuntu Jaunty, PostFix, and fetchmail.

  1. Log in on the Ubuntu machine, and install said packages: sudo apt-get install lire postfix fetchmail apache2 dovecot-common emacs [19] [20]

    Now also install some Perl modules:


      sudo perl -MCPAN -e 'install XML::Parser, MIME::Tools, Curses::UI, Sub::Exporter'

    1. First, configure PostFix it as a satellite system with a smarthost. You can use dpkg-reconfigure postfix to re-run the configuration process if you haven't already configured it like that in the previous step. Add the following line to /etc/postfix/main.cf to enable maildir-style mailboxes:

        mail_spool_directory = /var/mail/
      	    

      Then restart postfix: sudo /etc/init.d/postfix/restart

      Also (standard good practice) edit /etc/aliases to send root mail to a real person. While you're at it, create a couple of maildirs 'accounts' in /etc/aliases too:

      apache2:       /var/spool/lire/apache2/Maildir/
      postfix:       /var/spool/lire/postfix/Maildir/
      	    

      Don't forget to run postalias on that file.

    2. Now also create the maildirs, and give ownership to nobody, the user as which Postfix delivers mail.

      [Warning]Warning

      ToDo: create an actual system account especially for this

      sudo mkdir -p /var/spool/lire/{postfix,apache2}/Maildir/{tmp,new,cur}
      sudo chown -R nobody /var/spool/lire/*

    3. Now send a mail from a local account and see whether PostFix delivers it below /var/spool/lire/apache2/. If not, tail /var/log/mail.log for hints.

      echo "blah"|mailx -s test2 apache2@localhost
      find /var/spool/lire/
      /var/spool/lire/apache2/
      /var/spool/lire/apache2/cur
      /var/spool/lire/apache2/tmp
      /var/spool/lire/apache2/new
      /var/spool/lire/apache2/new/1236899044.V808I238b2M333495.cit-zb-13-81

      After a while, this shows up in /var/log/mail.log:

      all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/dbmail/Maildir/new/
      all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/watchguard/Maildir/new/
      all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/iis_ftp/Maildir/new/
      all all none lr_spoold notice Skipping non-existent directory: /var/spool/lire/cups_pagelog/Maildir/new/
      bogus message: Can't locate package Exporter for @Lire::Config::Build::ISA at /usr/share/perl5/Lire/Config.pm line 7.
      bogus message: Undefined subroutine &Lire::Config::ac_info called at /usr/share/perl5/Lire/Config.pm line 50.
      bogus message: BEGIN failed--compilation aborted at /usr/share/perl5/Lire/Program.pm line 174.
      bogus message: Compilation failed in require at /usr/share/lire/lib/lire/lr_getbody line 10.
      bogus message: BEGIN failed--compilation aborted at /usr/share/lire/lib/lire/lr_getbody line 10.
      all postfix lr_tag-20090313070738-22471 lr_processmail warning lr_getbody didn't completed successfully
      all postfix lr_tag-20090313070738-22471 lr_processmail err No submitter can be found. Keeping /tmp/lr_processmail.postfix.lr_tag-20090313070738-22471.nvBgom.mail for debugging
      all all lr_tag-20090313070738-22471 lr_spool err lr_processmail postfix on file '/tmp/1236924314.V808I238b4M604047.cit-zb-39-54' failed, moving to /var/lib/lire/data/email/raw/failed
      bogus message: mv: cannot move `/tmp/1236924314.V808I238b4M604047.cit-zb-39-54' to `/var/lib/lire/data/email/raw/failed': No such file or directory

    1. Start the responder manually: sudo lr_run lr_spoold& (Later on, we're going to create an initscript for this).

    2. Send the local postfix log to the analyzer to see if it reacts: cat /var/log/mail.log |mailx -s postfix-analysis-test postfix@localhost

      [Note]Note

      The log analyzer is a cron kind of thing, so reactionmay not be immediate. Be patient.

      [Note]Note

      Whether the results show up in your mailbox on the system on the system at hand or somewhere else of course depends on whether you properly configured an alias for yourself.



[19] The package dovecot-common brings maildirmake, which the Lire script lr_setup_responder needs later on.

[20] Emacs just because I like it as an editor