Graylog Extractors for pfSense 2.2 filter logs

Hi all,

I’m trying out Graylog for log collection, aggregation, and analysis. It’s free and pretty damn easy to deploy, available in OVA format.

The first thing I noticed is there seemed to be no extractors for pfSense 2.2’s new log format. Extractors allow you to parse a syslog message and place certain values into ‘fields’ for analysis or use in graphs.

Here’s one I prepared relatively quickly. You can import by:

  1. Click System -> Inputs in the Graylog UI
  2. Click ‘Manage extractors’ next to the relevant input
  3. Click ‘Import extractors’ in the ‘Actions’ menu at the top right of the page
  4. Paste the below script into the window and then click ‘Add extractors to input’

The extractors will parse the following fields out of the pfSense 2.2 filterlog messages:

  • Rule number into pfsense_filter_rulenum
  • Direction into pfsense_filter_direction
  • Ingress interface into pfsense_filter_ingress
  • Action into pfsense_filter_action
  • Protocol into pfsense_filter_proto
  • Source IP into pfsense_filter_sourceip
  • Source Port into pfsense_filter_sourceport
  • Destination IP into pfsense_filter_destip
  • Destination Port into pfsense_filter_destport

Right now they only interpret IPv4 logs, IPv6 log entries don’t get parsed (thanks to the condition regex) as they are formatted differently.

The script is available here, or click ‘Continue Reading’.

Hope this helps!

(more…)

2013-10-19 15.59.01

Repurposing old dumb PCs as thin clients

If you work at a metal refinery, or anywhere that utilises H2S (Hydrogen Sulphide), you might be familiar with this sight.

These computers are old, and dead, owing to their HDDs being corroded by the rotten-egg smelling gas that floats around the refinery they’re located at.

Our goal at this site is to move everyone around the refinery onto Teradici zero clients, and utilize our VMware View instance. Desktops (including apps and data) will be safe and sound in the datacenter, and the users won’t be subjected to losing their desktops and waiting for a replacement.

We purchased 100 Teradici based Zero Clients, and we were left with a lot of old PCs without a working HDD. What were we to do with them? eBay? Donating them somewhere?

The kill-two-birds-with-one-stone solution was Stratodesk’s “NoTouch” suite, something that caught my eye at VMworld last month. NoTouch OS is a relatively small linux distro that provides clients for most of the major hosted-desktop systems (like VMware View, Citrix, Microsoft RDSH, etc) and gives you the ability to repurpose dated PCs as thin clients.

NoTouch OS is managed through their NoTouch Center software, which they supply as a standalone install, or a virtual appliance. Through it you can group your endpoints and apply settings at any level. You could have a group of endpoints that connect to your VDI system for your employees, and a group of endpoints that provide nothing but a web browser pointing to your timesheet system for contractors to use. It’s very flexible and packed with functionality.

The Stratodesk Virtual Appliance also gives you a PXE boot server, and this is what we’re using for our PC-sans-HDDs. Just import the NoTouch OS image through the virtual appliance’s web interface, configure some boot options, pop some options into your DHCP servers, and away you go.

We’ve got 25 of these endpoints running throughout the plant, and user feedback is good. We had a couple of issues with managing multimonitor modes and auto-assigning endpoints to groups, and their support was both quick and extremely helpful. I had a response within the first couple hours, and they had solved the issues within 6 hours. On a Saturday. At night. And before we even purchased a license!

The PCoIP client built into NoTouch desktop is the official Linux VMware Horizon View client, and NoTouch lets you configure it however you want. Note that with Horizon View 5.3 you’ll be able to do RTAV through the Linux client, allowing you to use your USB webcams through a NoTouch endpoint. This gives it an advantage over the Teradici Zero Clients, as they’re yet to support RTAV (though sources tell me they are working on it).

They offer a free trial that allows you to manage 2 endpoints, I highly recommend giving it a try before you go and purchase any more zero clients. Licensing works out to around $46 per endpoint (retail) including a year of maintenance, and you can purchase licenses either through a vendor or direct.

Here’s a quick video demonstrating PXE booting a PC with no HDD into the NoTouch OS.

I’m finding it hard to justify purchasing more Zero Clients. Feel free to comment below with arguments for/against PC repurposing software like this! I’d love to hear your opinion.