Nulog

Nulog is a firewall log analysis interface that is written in PHP, which utilizes Netfilter to log selected packets directly into a database, such as MySQL or PostgreSQL. This interface allows for security events to be displayed in real-time on a user-friendly interface. Some of the key features of Nulog include showing the last hosts that sent packets that were blocked by the firewall, displaying the last ports that hosts tried to open, and searching for packets logged from a particular host, port, or user.

To get started with Nulog, the first step is to set up the database by creating a MySQL database called ulogd and populating it with ulogd.mysqldump. Users will need to enter their user and password in the include/require.inc file. It is important to note that this database is not the standard MySQL database for ulogd, as it adds a few tables and indexes to ensure optimal performance.

Once the database is set up, users will need to configure their netfilter installation if they are not using EdenWall or NuFW. Logging bad packets requires the use of ULOG, which can be done through the following command: iptables -A FORWARD -j ULOG --ulog-nlgroup 1 --ulog-prefix "badif".

The latest release of Nulog allows for MySQL triggers to be used instead of PHP code to compute statistical data. With its user-friendly interface and helpful features, Nulog is a reliable choice for analyzing firewall logs.