我想将sshd
日志条目中的源 IP 地址从内部保存到 mysql 数据库中syslog-ng
。目前,我已定义一个过滤器,该过滤器与所需日志条目的子字符串匹配。
我可以将整个日志条目保存到数据库中,但是$MSG
系统日志条目的一部分包含大量我不想要的额外数据。有没有办法“拆分”系统日志条目的字段,以便仅将 IP 地址写入数据库?
这是我的配置:
filter f_sshd
{
# (log entry) Sep 5 14:59:20 myhost4 sshd Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0
match("Starting session:" value ("MESSAGE") );
};
destination d_sshd
{
sql( type(mysql)
username("xxxxx")
password("xxxxxxx")
database("syslog")
host("localhost")
table("ssh")
columns("host", "facility", "priority", "level", "pid", "tag", "timestamp", "program", "msg")
values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$PID", "$TAG","$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC","$PROGRAM", "$MSG")
indexes("timestamp", "host", "program", "pid", "message"));
};
log
{
# s_stunnel is defined in syslog-ng/conf.d/stunnel.conf
source(s_stunnel);
filter(f_sshd);
destination(d_sshd);
};
答案1
您可以使用创建解析器syslog-ng-patterndb提取消息的部分内容。
创建 XML 文件来定义你的解析器(/etc/syslog-ng/template_sshd.xml
):
<patterndb version='4' pub_date='2010-10-17'>
<ruleset name='ssh' id='123456678'>
<pattern>ssh</pattern>
<rules>
<rule provider='me' id='182437592347598' class='system'>
<patterns>
<pattern>Starting session: shell on @ESTRING:SSH_TERMINAL: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ id @NUMBER:SSH_ID@</pattern>
</patterns>
<examples>
<example>
<test_message program="ssh">Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0</test_message>
<test_values>
<test_value name="SSH_TERMINAL">pts/0</test_value>
<test_value name="SSH_USERNAME">sampleuser</test_value>
<test_value name="SSH_CLIENT_ADDRESS">192.168.10.12</test_value>
<test_value name="SSH_PORT_NUMBER">42156</test_value>
<test_value name="SSH_ID">1</test_value>
</test_values>
</example>
</examples>
</rule>
</rules>
</ruleset>
</patterndb>
然后在你的syslog-ng.conf
:
定义解析器:
parser sshd_pattern { db_parser(file("/etc/syslog-ng/template_sshd.xml")); };
在您的日志指令中调用解析器:
log
{
# s_stunnel is defined in syslog-ng/conf.d/stunnel.conf
source(s_stunnel);
parser(sshd_pattern); <---- call parser
filter(f_sshd);
destination(d_sshd);
};
SSH_CLIENT_ADDRESS
在目标中使用解析器的变量:
destination d_sshd
{
file("/var/log/sshd.log"
template("${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS}; ${HOST}; ${FACILITY}; ${PRIORITY}; ${LEVEL}; ${PID}; ${TAG}; ${YEAR}-${MONTH}-${DAY} ${HOUR}:${MIN}:${SEC}; ${PROGRAM}; \n")
template_escape(no)
);
};
单元测试运行:
pdbtool match -P "ssh" -M "Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0" -p template_sshd.xml -c -D -v
应该返回:
SSH_TERMINAL=pts/0
SSH_USERNAME=rbackup
SSH_CLIENT_ADDRESS=10.120.192.25
SSH_PORT_NUMBER=36894
SSH_ID=0
改编自此链接:https://gist.github.com/linickx/8002981
根据您的评论进行以下编辑:
理想情况下,SSH_TERMINAL 密钥可以吞掉从 session: 后的空格到 bareword 的所有内容
像这样更改 XML 中的模式:
<pattern>Starting session: @ESTRING:SSH_TERMINAL:from @@ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ id @NUMBER:SSH_ID@</pattern>
返回:
# pdbtool match -P "ssh" -M "Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0" -p template_sshd.xml -c -D -v
SSH_TERMINAL=shell on pts/0 for rbackup <-- you got all between "session:" to "from"
SSH_CLIENT_ADDRESS=10.120.192.25
SSH_PORT_NUMBER=36894
SSH_ID=0
关于模式解析器的进一步阅读:https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/72