EDITED: added a Layer3 socket code to speed up the script
I have written this python script that reads log files and re-transmit this data as [network] Syslog traffic .. it may help somebody else who is trying to solve the same problem!
#!/usr/bin/python
# Description: this script retransmits syslog data from flat files to network traffic
# Non-standard dependencies: Scapy libraries
# To use this script on own environment, adjust the GLOBAL VARIABLES section below accordingly
# It will also need to run under sudo because of the use of Scapy
###########
from scapy.all import *
from os import walk
from re import search
import subprocess
import time
#
# As this script will be running from a cronjob once every X minutes, i'll check if it's already
# running before launching a new instance. If one is already running, this script will exit
# The reason it gets relaunched via a cronjob is to have some resilience in case it crashes or forced
# to exit by other external factors
#
pids = subprocess.check_output('pidof -x "textlogs2syslog.py"', shell=True, text=True)
pids = pids.split()
if len(pids) > 1:
print ("Another process is running .. I'm exiting")
exit(1)
#
# GLOBAL VARIABLES
#
source_dir = '/path/to/incoming/' # directory where log files will be picked up from
dest_ip = '10.0.0.63' # destination syslog server
source_port = 10000 # can be changed
dest_port = 514 # destination port number for the SIEM syslog server
archive_path = '/path/to/archive/' # where files will be moved to after processing
#
# this script will run until SIGINT
#
while True:
f = []
for (dirpath, dirnames, filenames) in walk(source_dir):
f.extend(filenames)
for file in f:
if search("^logs_", file):
try: # extract the IP address from the file name, filenames have this naming convention: logs_[IPv4_ADDRESS]_*.*
ip = re.search('^.*_(.+?)_', file).group(1)
source_ip = ip
except AttributeError:
pass
else: # ignores and skip non-conformant filenames
continue
# open the log file and assign a handle to it
file_handle = open(source_dir + file, 'r')
Lines = file_handle.readlines()
# iterate through the text file line by line before transferring every line as a Syslog event
# this is where Scapy gets used to generate the network traffic
s = conf.L3socket()
for line in Lines:
payload = "<134>1 " + line.strip() # strips the newline character
# <134> prepend this to reinstate the syslog event facility header
# 1 prepend this to reinstate the syslog event priority header
spoofed_packet = IP(src=source_ip, dst=dest_ip) / UDP(sport=source_port, dport=dest_port) / payload
s.send(spoofed_packet)
# iterating through a single log file ends here
# when done with transmitting the file content, the log file will be moved to an archive directory
os.system("mv " + source_dir + file + " " + archive_path)
break
print("finished iterating through files, will sleep and try again")
time.sleep(0.01)
