☰

NxLog 的“与”逻辑

tag-icon • tag-icon windows logging nxlog
NxLog 的“与”逻辑

我目前在各种域控制器上运行 NxLog，提取登录/注销事件。

Exec if $TargetUserName =~ /(\S+\$|user1|user2|user3|user4)/ drop(); \
     else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID == 4768) $raw_event = "Time:" + $EventTime + ", EventID:" + $EventID + ", Keyword:" + $Status + ", LogonType:" + $LogonType + ", User:" + $TargetDomainName + "\\" + $TargetUserName + ", IPAddr:" + $IPAddress; \
     else if $raw_event =~ /^(.+)(Detailed Authentication Information:|Additional Information:)/ $raw_event = $1; if $raw_event =~ s/\t/  /g {}

虽然上面的配置工作正常，但事实上它会忽略带有 $ 的用户名以及我指定的用户名，我只想忽略带有这些用户名的事件 ID 4624，这样我仍然可以看到失败的登录。我以为下面的配置会起作用，但我一直收到语法错误。

Exec if ($EventID == 4624 and $TargetUserName =~ /(\S+\$|user1|user2|user3|user4)/ drop(); \
     else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID == 4768) $raw_event = "Time:" + $EventTime + ", EventID:" + $EventID + ", Keyword:" + $Status + ", LogonType:" + $LogonType + ", User:" + $TargetDomainName + "\\" + $TargetUserName + ", IPAddr:" + $IPAddress; \
     else if $raw_event =~ /^(.+)(Detailed Authentication Information:|Additional Information:)/ $raw_event = $1; if $raw_event =~ s/\t/  /g {}

任何帮助将不胜感激。

编辑：为了完整起见，下面是我的最终配置，用于排除带有 $ 的用户名，然后排除我不关心的各种聊天帐户上的成功/Kerb 事件。

Exec if $TargetUserName =~ /(\S+\$)/ drop(); \
     else if ($EventID == 4624 and $TargetUserName =~ /(user1|user2|user3|user4)/) drop(); \
     else if ($EventID == 4648 and $TargetUserName =~ /(user1|user2|user3|user4)/) drop(); \
     else if ($EventID == 4624 or $EventID == 4625 or $EventID == 4648 or $EventID == 4768) $raw_event = "Time:" + $EventTime + ", EventID:" + $EventID + ", Keyword:" + $Status + ", LogonType:" + $LogonType + ", User:" + $TargetDomainName + "\\" + $TargetUserName + ", IPAddr:" + $IPAddress; \
     else if $raw_event =~ /^(.+)(Detailed Authentication Information:|Additional Information:)/ $raw_event = $1; if $raw_event =~ s/\t/  /g {}

答案1

语法错误的原因是你的括号没有正确配对。应该是这样的：

Exec if ($EventID == 4624 ... ) drop(); 
        ^                     ^

相关内容