Falcon Server File Monitoring Platform Installation configuration and troubleshooting

Falcon Server File Monitoring Platform Installation configuration and troubleshooting

Falcon is a Web Server File monitoring platform developed based on inotify-tools. It monitors Web directory file changes (new, modified, and deleted) in real time and determines whether the file content contains malicious code, automatically isolates common webshells to ensure the security of Web directory files.
: Https://github.com/secrule/falcon
The official installation and configuration process is as follows:
How to install and start monitoring:

Step 1: decompress and check the compiling environment of the program.

Tar-zxvf falcon.tar.gz

Cd Release/

./Check. sh # note that an error is reported if the required support file is not installed. For specific solutions, see the second half of this document.

The following information proves that the program compilation environment is ready.

Found inotify success!

Found inotifytools success!

Found mysql-dev environment success!

Step 2: Install Falcon Control Center

Vi./falconconsole/public/config. inc. php

Modify the database connection information in the configuration file. If the control center and monitoring program are not installed on the same host, ensure that the monitored host has the right to access the Mysql database of the host Where the control center is located.

Run install. php to install the Control Center

Step 3: Modify the monitoring program configuration file and compile

This section mainly sets the database connection information. The Web directory to be monitored ends "/".

Vim src/conf/global. conf

Note that you need to go to the download package's realbench folder for compilation.

Make
A falcon file will be generated if it succeeds.

Step 4: run the monitoring program in the background

Nohup./falcon start> falcon. log2> & 1 &

Ps aux | grep "falcon"

The following describes the problems encountered during the installation and solutions.

I. "/usr/bin/ld: cannot find-lmysqlclient"

The mysql client is not installed or the corresponding file is not found. This error usually occurs on the x64 system. solution:

1. Install the mysql client

Yum-y install mysql-devel

2. Set a soft connection

Backup/usr/lib/mysql

Mv/usr/lib/mysql. bak

Set soft connection

Ln-s/usr/lib64/mysql // usr/lib/mysql

Ii. cannot find-liconv collect2: ld returned 1 exit status

Iconv is not installed. You need to install it manually.

Solution:

Package download page http://www.gnu.org/software/libiconv/

# Wget http://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.14.tar.gz # tar-zxvf libiconv-1.14.tar.gz

# Cd libiconv-1.14.1

#./Configure

# Make

# Make install

If an error is reported after installation, you need to set up a soft connection.

Ln-s/usr/local/lib/libiconv. so.2/usr/lib64/libiconv. so.2

Iii. "./falcon: error while loading shared libraries: libinotifytools. so.0: cannot open shared object file: No such file ordirectory"

Libinotifytools. so.0 not found

Solution:

Set soft connection

Ln-s/usr/local/lib/libinotifytools. so.0/usr/lib64/libinotifytools. so.0