Hi all, I posted the below to the ulogd mailing lists sometime ago, but the list seems to be dead (not alot of activity on it for sometime now). I was hoping someone here might be able to help me out. I'm running Bering as my firewall. All I want to be able to do is log my firewall traffic to a mysql db via ulogd Cheers Ad
Background:
I wish to statically link ulogd and mainly the MYSQL plugin. I wish to
update the uplogd package on my leaf (linux router) box.
So I grab'd the MYSQL source (4.0.18) and compiled it with the following
CFLAGS="-O3 -mcpu=pentiumpro" CXX=gcc CXXFLAGS="-O3 -mcpu=pentiumpro \
-felide-constructors -fno-exceptions -fno-rtti" ./configure \
--without-server \
--prefix=/usr/local/mysql \
--enable-assembler \
--with-client-ldflags=-all-static
I then updated /etc/ld.so.conf with
/usr/local/mysql/lib/mysql
ldconfig -v
<snip>
/usr/local/mysql/lib/mysql:
libmysqlclient.so.12 -> libmysqlclient.so.12.0.0
<snip>
unpacked ulogd-1.02
I have edited Rules.make.in to change the config location etc
ULOGD_CONFIGFILE=/etc/ulogd.conf
and the mysql location
MYSQL_CFLAGS=-I/usr/local/mysql/include
./configure --with-mysql
make
make install
I test this first and all works perfectly (well I assume it does ulogd loads
without any errors, because this is a VirtualPC I didn't bother to check if
it is ACTUALLY logging to mysql just yet.)
[EMAIL PROTECTED] sbin]# ulogd
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `raw'
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `oob'
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `ip'
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `tcp'
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `icmp'
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `udp'
Thu Apr 29 22:56:00 2004 <3> ulogd.c:300 registering interpreter `ahesp'
Thu Apr 29 22:56:00 2004 <1> ulogd_MYSQL.c:218 allocating 4304 bytes for
statement
Thu Apr 29 22:56:00 2004 <1> ulogd_MYSQL.c:242 stmt='insert into ulog
(ahesp_spi,icmp_fragmtu,icmp_gateway,icmp_echoseq,icmp_echoid,icmp_code,icmp
_type,udp_len,udp_dport,udp_sport,tcp_fin,tcp_syn,tcp_rst,tcp_psh,tcp_ack,tc
p_urgp,tcp_urg,tcp_window,tcp_ackseq,tcp_seq,tcp_dport,tcp_sport,ip_fragoff,
ip_id,ip_csum,ip_ihl,ip_totlen,ip_ttl,ip_tos,ip_protocol,ip_daddr,ip_saddr,o
ob_out,oob_in,oob_mark,oob_prefix,oob_time_usec,oob_time_sec,raw_mac) values
('
Thu Apr 29 22:56:00 2004 <5> ulogd.c:355 registering output `mysql'
Thu Apr 29 22:56:00 2004 <5> ulogd.c:355 registering output `syslogemu'
Now because my leaf router is your "run of the mill" LRP box
(leaf.sourceforge.net) I figured I need to link ulogd + plugins statically.
Because I'm not too savvy with linux I just edited the Rules.make.in and
changed
LD=ld
to
LD=ld -static
Then a ./configure --with-mysql
make clean
make
make install
But when I fire up ulogd I get the following
[EMAIL PROTECTED] sbin]# ulogd
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `raw'
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `oob'
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `ip'
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `tcp'
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `icmp'
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `udp'
Thu Apr 29 23:12:43 2004 <3> ulogd.c:300 registering interpreter `ahesp'
Thu Apr 29 23:12:43 2004 <7> ulogd.c:460 load_plugins:
'/usr/local/lib/ulogd/ulogd_MYSQL.so': /usr/local/lib/ulogd/ulogd_MYSQL.so:
undefined symbol: mysql_real_escape_string
Thu Apr 29 23:12:43 2004 <5> ulogd.c:355 registering output `syslogemu'
Thu Apr 29 23:12:43 2004 <7> ulogd.c:460 load_plugins:
'/usr/local/lib/ulogd/ulogd_MYSQL.so': /usr/local/lib/ulogd/ulogd_MYSQL.so:
undefined symbol: mysql_real_escape_string
I'm not sure what/where to go from here.
The box is a RH9 box
[EMAIL PROTECTED] sbin]# uname -a
Linux blah 2.4.20-8 #1 Thu Mar 13 17:54:28 EST 2003 i686 i686 i386 GNU/Linux
[EMAIL PROTECTED] sbin]# gcc --version
gcc (GCC) 3.2.2 20030222 (Red Hat Linux 3.2.2-5)
[EMAIL PROTECTED] bin]# ./mysqladmin --version
./mysqladmin Ver 8.40 Distrib 4.0.18, for pc-linux on i686
I'm not sure what other information I need to include.
smime.p7s
Description: S/MIME cryptographic signature
