Simple TCP/IP receiver

mgai7755 · 07-02-2012, 12:36 PM

Hi,

I'm looking for a simple tool or way to receive and log a text stream (log file) send by a client (squid) on a TCP port.

The TCP server would need to be launched automatically at boot.

I also need to be able to rotate the generated log file using logrotate.

Anybody could point me to a solution ? FYI The server is a Debian.

Thanks

Matt

TB0ne · 07-02-2012, 01:00 PM

Quote:

Originally Posted by mgai7755

Hi,
I'm looking for a simple tool or way to receive and log a text stream (log file) send by a client (squid) on a TCP port.

The TCP server would need to be launched automatically at boot. I also need to be able to rotate the generated log file using logrotate. Anybody could point me to a solution ? FYI The server is a Debian.

Read about the access_log directive for squid:
http://www.squid-cache.org/Doc/config/access_log/

Set it to be "syslog"; anything logged to the squid logs will then be sent to your syslog server. Since you can send your syslog events to a REMOTE syslog server (preferably running syslog-ng, so you can separate things into different files for different servers), that will mean your squid events will go to a remote syslog server into a file. From there, set up logrotate to perform how you wish. Syslog servers should normally be started at boot time.

zwcbz · 07-02-2012, 03:39 PM

Hi there, have you checked out NetCat yet? It;s known as the TCP/IP swiss army knife

mgai7755 · 07-03-2012, 03:56 AM

Quote:

Originally Posted by TB0ne

Read about the access_log directive for squid:
http://www.squid-cache.org/Doc/config/access_log/

Set it to be "syslog"; anything logged to the squid logs will then be sent to your syslog server. Since you can send your syslog events to a REMOTE syslog server (preferably running syslog-ng, so you can separate things into different files for different servers), that will mean your squid events will go to a remote syslog server into a file. From there, set up logrotate to perform how you wish. Syslog servers should normally be started at boot time.

Thanks TB0ne. I'm aware of this possibility and managed to get it work. However, there are multiple difficulties linked to this way of doing it :

PfSense's syslog server doesn't support sending messages over a TCP link. UDP isn't reliable enough in this case.
My file server is coming with an old rsyslog server which doesn't implement a way to send the remote messages in a particular file, meaning squid's messages are sent to the syslog.log file together with local events.
And last but not least, I think my version of rsyslog doesn't support the template system that is needed to remove the timestamps normally added before each message received. That means that a squid log analyzer would be unable to handle the log file.

Therefore, I thought is was easier and more reliable to use squid's ability to send the logs through a simple TCP link.

mgai7755 · 07-03-2012, 06:43 AM

Quote:

Originally Posted by zwcbz

Hi there, have you checked out NetCat yet? It;s known as the TCP/IP swiss army knife

That's indeed a good direction ! I succeeded testing with nc -l -p 1698 > pfsense.log to open port 1698 to listen.

Two questions :

* I noticed the process quit when the connexion is closed from the client side. Is there a way to keep the server from closing ?
* I'm not so good at Linux... How can I add safely and reliably to the startup items ? (Automatic start at boot and restart in case of failure)

Thanks

Matt