Strongswan loglevel

Allgemein

• strongswan-logs sind sehr variabel. Es lässt sich sehr genau festlegen, was strongswan wohin schreiben soll
• strongswan schreibt alle logs standardmäßig in /var/log/syslog

Loglevel festlegen

über Konsole

• ipsec stroke loglevel <Quelle> <Loglevel>
  • Für "<Loglevel>" können die Werte -1, 0, 1, 2, 3 und 4 verwendet werden
  • Für "<Quelle>" können die Werte app, asn, cfg, chd, dmn, enc, esp, ike, imc, imv, job, knl, lib, mgr, net, pts, tls und tnc oder alternativ auch "any" für alle gleichzeitig verwendet werden

Beispiele

enc bzw. ike loglevel 2

• ipsec stroke loglevel enc 2
• ipsec stroke loglevel ike 2

Log abschalten

• ipsec stroke loglevel any -- -1

in /etc/ipsec.conf

• Um den Log-Level festzulegen muss in die "setup"-Sektion der ipsec.conf lediglich ein Parameter "charondebug" in der folgenden Weiße hinzugefügt werden

config setup
            charondebug="cfg 2, chd 2, esp 2, ike 2, knl 2, lib 2, net 2, tls 2"

ACHTUNG!!!

• Wegen eines Bugs im Parameter "app", den man deshalb hier nicht verwenden sollte, lässt sich hier die Option "any" ebenfalls nicht verwenden, daher müssen bei dieser Variante alle ins log zu schreibenden Quellen einzeln angegeben werden

in /etc/strongswan.conf

charon {
	load_modular = yes
        filelog {
        /var/log/charon.log {
            time_format = %b %e %T
            ike_name = yes
            append = yes
            ike = 2
            enc = 2
            default = 0
            flush_line = yes
       }
        stderr {
            ike = 2
            knl = 3
        }
	}
      plugins {
		include strongswan.d/charon/*.conf
	}
}
include strongswan.d/*.conf

restart

• ipsec restart

VPN Check

• CONN=s2s
• CHECK="(CHILD_SA|failed|error|could not)"

Initiator

Verbindung erfolgreich

• tail -f /var/log/strongswan/charon.log | grep

Nov 16 11:26:44 15[IKE] <s2s|6> CHILD_SA s2s{3} established with SPIs cbe2c3f8_i c64ca73c_o and TS 10.83.33.0/24 === 10.83.32.0/24

Beispiele für Log-Level

ipsec stroke loglevel ike 0

Sep  5 16:17:52 gustavo charon: 12[IKE] 10.84.252.31 is initiating a Main Mode IKE_SA
Sep  5 16:17:52 gustavo charon: 05[IKE] IKE_SA s2s[4] established between 10.84.252.33[gustavo]...10.84.252.31[zee]
Sep  5 16:17:52 gustavo charon: 06[IKE] CHILD_SA s2s{6} established with SPIs c06b8e7f_i c53d1a19_o and TS 10.83.33.0/24 === 10.83.31.0/24

ipsec stroke loglevel ike 1

Sep  5 16:21:46 gustavo charon: 05[IKE] received XAuth vendor ID
Sep  5 16:21:46 gustavo charon: 05[IKE] received DPD vendor ID
Sep  5 16:21:46 gustavo charon: 05[IKE] received NAT-T (RFC 3947) vendor ID
Sep  5 16:21:46 gustavo charon: 05[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Sep  5 16:21:46 gustavo charon: 05[IKE] 10.84.252.31 is initiating a Main Mode IKE_SA
Sep  5 16:21:46 gustavo charon: 02[IKE] IKE_SA s2s[9] established between 10.84.252.33[gustavo]...10.84.252.31[zee]
Sep  5 16:21:46 gustavo charon: 02[IKE] scheduling reauthentication in 9995s
Sep  5 16:21:46 gustavo charon: 02[IKE] maximum IKE_SA lifetime 10535s
Sep  5 16:21:46 gustavo charon: 11[IKE] CHILD_SA s2s{11} established with SPIs cebd6069_i cd1999bd_o and TS 10.83.33.0/24 === 10.83.31.0/24

ipsec stroke loglevel ike 2

Sep  5 16:19:21 gustavo charon: 13[IKE] received XAuth vendor ID
Sep  5 16:19:21 gustavo charon: 13[IKE] received DPD vendor ID
Sep  5 16:19:21 gustavo charon: 13[IKE] received NAT-T (RFC 3947) vendor ID
Sep  5 16:19:21 gustavo charon: 13[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Sep  5 16:19:21 gustavo charon: 13[IKE] 10.84.252.31 is initiating a Main Mode IKE_SA
Sep  5 16:19:21 gustavo charon: 13[IKE] IKE_SA (unnamed)[6] state change: CREATED => CONNECTING
Sep  5 16:19:21 gustavo charon: 13[IKE] sending XAuth vendor ID
Sep  5 16:19:21 gustavo charon: 13[IKE] sending DPD vendor ID
Sep  5 16:19:21 gustavo charon: 13[IKE] sending NAT-T (RFC 3947) vendor ID
Sep  5 16:19:21 gustavo charon: 02[IKE] IKE_SA s2s[6] established between 10.84.252.33[gustavo]...10.84.252.31[zee]
Sep  5 16:19:21 gustavo charon: 02[IKE] IKE_SA s2s[6] state change: CONNECTING => ESTABLISHED
Sep  5 16:19:21 gustavo charon: 02[IKE] scheduling reauthentication in 10080s
Sep  5 16:19:21 gustavo charon: 02[IKE] maximum IKE_SA lifetime 10620s
Sep  5 16:19:21 gustavo charon: 04[IKE] CHILD_SA s2s{8} established with SPIs cc0eb77c_i c53ca16e_o and TS 10.83.33.0/24 === 10.83.31.0/24

Links

• https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration