我想知道您是否能帮助解答以下问题?
我的办公室里有一台客户端 (Centos 7) 服务器 (IP 1.1.1.1),它将其日志发送到 Centos 7 Syslog 服务器 (IP 地址 1.1.1.2)。Syslog 服务器将其日志转发到 Centos 7 Graylog v1.1.1 服务器 (IP 地址 2.2.2.1)。据我所知,这三台设备可以成功相互通信,并使用默认端口和配置。
我的问题如下:Graylog 服务器上显示的日志具有我的 syslog 服务器 (1.1.1.2) 的源 IP 地址和 gl2_remote_ip。我希望源 IP 地址(甚至 gl2_remote_ip)是客户端服务器 (1.1.1.1) 的 IP 地址。
到目前为止,我已经研究过使用提取器从消息字段中提取 IP 地址(如下所示),目前正在编写 drool 脚本。
facility local1
full_message <142>May 31 15:11:57 1.1.1.1 116: .May 31 14:11:52.321: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 1.1.1.2 started - CLI initiated
gl2_remote_ip 1.1.1.2
gl2_remote_port 40331
level 6
message 1.1.1.1 116: .May 31 14:11:52.321: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 1.1.1.2 started - CLI initiated
source 1.1.1.2
然而,每次我尝试使用正则表达式命令(我使用网站进行测试)http://www.regextester.com/) Graylog 给我一个错误,告诉我我的正则表达式有问题。我已阅读完 Graylog 文档,据我所知,它使用的正则表达式应该是相当标准的,但有人能告诉我它是什么类型的吗?
根据测试人员的说法,此正则表达式行应该有效:
\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b
因此,总而言之,有人可以帮助我从 Graylog 消息的一部分中提取值并将它们添加回消息的另一部分吗?
我希望消息的最终结果如下所示:
facility local1
full_message <142>May 31 15:11:57 1.1.1.1 116: .May 31 14:11:52.321: %SYS-6-
LOGGINGHOST_STARTSTOP: Logging to host 1.1.1.2 started - CLI initiated
gl2_remote_ip 1.1.1.1
gl2_remote_port 40331
level 6
message 1.1.1.1 116: .May 31 14:11:52.321: %SYS-6-LOGGINGHOST_STARTSTOP:
Logging to host 1.1.1.2 started - CLI initiated
source 1.1.1.1
多谢。
答案1
yum 安装 syslog-ng
cat syslog-ng.conf @version:3.5 @include "scl.conf" # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # Note: it also sources additional configuration files (*.conf) # located in /etc/syslog-ng/conf.d/ options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { system(); internal(); udp(); syslog(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Source additional configuration files (.conf extension only) @include "/etc/syslog-ng/conf.d/*.conf" # vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:
进而
> cat conf.d/20-syslog.conf filter f_fiddling { facility(local0); }; log
> { source(s_sys); filter(f_fiddling); destination(fiddling); };
> destination fiddling { syslog ("77.75.109.11" transport ("udp") port
> (514) spoof_source(yes)); };