3
This patch adds the capability to syslog-ng that allows you to strip
4
out any given regexp or all IP addresses from log messages before
5
they are written to disk. The goal is to give the system administrator
6
the means to implement site logging policies, by allowing them easy
7
control over exactly what data they retain in their logfiles,
8
regardless of what a particular daemon might think is best.
12
Data retention has become a hot legal topic for ISPs and other Online
13
Service Providers (OSPs). There are many instances where it is preferable
14
to keep less information on users than is collected by default on many
15
systems. In the United States it is not currently required to retain
16
data on users of a server, but you may be required to provide all data
17
on a user which you have retained. OSPs can protect themselves from legal
18
hassles and added work by choosing what data they wish to retain.
20
From "Best Practices for Online Service Providers"
21
(http://www.eff.org/osp):
23
As an intermediary, the OSP [Online Service Provider] finds itself in
24
a position to collect and store detailed information about its users
25
and their online activities that may be of great interest to third
26
parties. The USA PATRIOT Act also provides the government with
27
expanded powers to request this information. As a result, OSP owners
28
must deal with requests from law enforcement and lawyers to hand over
29
private user information and logs. Yet, compliance with these demands
30
takes away from an OSP's goal of providing users with reliable,
31
secure network services. In this paper, EFF offers some suggestions,
32
both legal and technical, for best practices that balance the needs
33
of OSPs and their users' privacy and civil liberties.
35
Rather than scrubbing the information you don't want in logs, this patch
36
ensures that the information is never written to disk. Also, for those
37
daemons which log through syslog facilities, this patch provides a
38
convenient single configuration to limit what you wish to log.
40
Here are some related links:
42
Best Practices for Online Service Providers
43
http://www.eff.org/osp
44
http://www.eff.org/osp/20040819_OSPBestPractices.pdf
46
EPIC International Data Retention Page
47
http://www.epic.org/privacy/intl/data_retention.html
49
Working Paper on Usage Log Data Management (from Computer, Freedom, and
50
Privacy conference) http://cryptome.org/usage-logs.htm
53
Installing syslog-ng-anon
57
This patch has been tested against the following versions of syslog-ng:
58
. Debian package syslog-ng_2.0.5-2
60
To use this patch, obtain the source for syslog-ng
61
(apt-get source syslog-ng) and the
62
syslog-ng-anon patch (http://dev.riseup.net/patches/syslog-ng/).
63
Apply the patch the patch:
66
% patch -p1 < ../syslog-ng-anon.diff
68
Then compile and install syslog-ng:
70
% dpkg-buildpackage -rfakeroot -b
71
% dpkg -i ../syslog-ng_2.0.5-2_i386.deb
75
This patch adds the filter "strip". For example:
77
filter f_strip {strip(<regexp>);};
79
This will strip out all matches of the regular expression on logs to
80
which the filter is applied and replaces all matches with the fixed length
83
In place of a regular expression, you can put "ips", which will replace all
84
internet addresses with 0.0.0.0. For example:
86
filter f_strip {strip(ips);};
88
You can alter what the replacement strings are by using replace:
90
replace(ips,"0.0.0.0") <--- this is the same as strip(ips)
91
replace(<regex>,"----") <--- this is the same as strip(<regex>)
93
For a complete example, see the sample syslog-ng.conf file at
94
https://code.autistici.org/trac/privacy/browser/trunk/syslog-ng/syslog-ng.conf
added
removed
doc/reference/README.syslog-ng-anon
