Syslog-ng 未写入 2 个目的地

2024-6-6 • tag-icon

syslog

我已经将 syslog-ng 设置为记录到 MSSQL 目标，并且一切运行正常。但是，如果我使用单独的日志命令指定第二个目标（相同的数据库但不同的表），该命令使用不同的过滤器来识别我想要在该表中的流量，则日志记录不起作用。

我认为这与线程有关，所以我启用了线程，但仍然看到相同的情况。

我正在使用 Ubuntu 13.04 raring 和 syslog-ng OSE 3.5.3 版本。

还有谁见过这个问题吗？

谢谢皮特

感谢 Tom 的回复。syslog-ng.conf 文件的相关部分如下。我已将目标和日志都放在了我想要的数据表中。目前，这是一个测试，因此解析器是相同的，但我正在尝试分离流量，因为解析器会有所不同。

我发现，如果我启动 syslog-ng，有时我会将数据发送到其中一个数据库表，但不会发送到另一个数据库表，或者两个表都没有发送数据。我运行了 SQL 配置文件，但没有看到插入语句，所以这不是 SQL 问题。

其他可能产生影响的因素是，syslog-ng 服务器在 Hyper-V 上运行，但我为其分配了 4 个逻辑 CPU，但我想如果每个 SQL 目标使用单独的线程，Ubuntu 可能无法处理虚拟化，因此不会将 CPU 呈现给应用程序。

非常感谢您对此的想法。

以下是.conf文件的相关部分：

options { threaded(yes);};

source s_net { udp(ip(x.x.x.x) port(514) flags("syslog-protocol", "threaded")); };

destination d_mssql {
sql(type(mssql) host("x.x.x.x") port (1433) 
username("******") password("********") database("syslog-ng") 
table ("BMTHFWTRAFFICAccepted${R_DAY}${R_MONTH}${R_YEAR}") 
columns ("time varchar(16)", "devname varchar(50)", "device_id varchar(50", 
"log_id varchar(16)", "type varchar(16)", "subtype varchar(16)", "pri varchar(16)", 
"vd varchar(16)", "src varchar(16)", "src_port varchar(16)", "src_int varchar(16)", 
"dst varcar(16)", "dst_port varchar(16)", "dst_int varchar(16)", "sn varchar(16)", 
"statuc varchar(16)", "policyid varchar(16)", "dst_country varchar(255)", 
"src_country varchar(255)", "dir_disp varchar(16)", "tran_disp varchar(16)", 
"tran_ip varchar(16)", "tran_port varchar(16)", "service varchar(16)", "proto varchar(16)", 
"duration varchar(16)", "sent varchar(16)", "rcvd varchar(16)", "sent_pkt varchar(16)", 
"rcvd_pkt varchar(16)" 
values ("${FORTINET.time}", "${FORTINET.time}", "${FORTINET.devname}", "${FORTINET.device_id}", 
"${FORTINET.log_id}", "${FORTINET.type}", "${FORTINET.subtype}", "${FORTINET.pri}", 
"${FORTINET.vd}", "${FORTINET.src}", "${FORTINET.src_port}", "${FORTINET.src_int}", 
"${FORTINET.dst}", "${FORTINET.dst_port}", "${FORTINET.dst_int}", "${FORTINET.sn}", 
"${FORTINET.status}", "${FORTINET.policyid}", "${FORTINET.dst_country}", "${FORTINET.src_country}", 
"${FORTINET.dir_disp}", "${FORTINET.tran_disp}", "${FORTINET.tran_ip}", "${FORTINET.tran_port}", 
"${FORTINET.service}", "${FORTINET.proto}", "${FORTINET.duration}", "${FORTINET.sent}", 
"${FORTINET.rcvd}", "${FORTINET.sent_pkt}", "${FORTINET.rcvd_pkt}"));
};

destination d_mssql2 {
sql(type(mssql) host("x.x.x.x") port (1433) 
username("******") password("********") database("syslog-ng") 
table ("BMTHFWTRAFFICAccepted${R_DAY}${R_MONTH}${R_YEAR}") 
columns ("time varchar(16)", "devname varchar(50)", "device_id varchar(50", 
"log_id varchar(16)", "type varchar(16)", "subtype varchar(16)", "pri varchar(16)", 
"vd varchar(16)", "src varchar(16)", "src_port varchar(16)", "src_int varchar(16)", 
"dst varcar(16)", "dst_port varchar(16)", "dst_int varchar(16)", "sn varchar(16)", 
"statuc varchar(16)", "policyid varchar(16)", "dst_country varchar(255)", 
"src_country varchar(255)", "dir_disp varchar(16)", "tran_disp varchar(16)", 
"tran_ip varchar(16)", "tran_port varchar(16)", "service varchar(16)", "proto varchar(16)", 
"duration varchar(16)", "sent varchar(16)", "rcvd varchar(16)", "sent_pkt varchar(16)", 
"rcvd_pkt varchar(16)" 
values ("${FORTINET.time}", "${FORTINET.time}", "${FORTINET.devname}", "${FORTINET.device_id}", 
"${FORTINET.log_id}", "${FORTINET.type}", "${FORTINET.subtype}", "${FORTINET.pri}", 
"${FORTINET.vd}", "${FORTINET.src}", "${FORTINET.src_port}", "${FORTINET.src_int}", 
"${FORTINET.dst}", "${FORTINET.dst_port}", "${FORTINET.dst_int}", "${FORTINET.sn}", 
"${FORTINET.status}", "${FORTINET.policyid}", "${FORTINET.dst_country}", "${FORTINET.src_country}", 
"${FORTINET.dir_disp}", "${FORTINET.tran_disp}", "${FORTINET.tran_ip}", "${FORTINET.tran_port}", 
"${FORTINET.service}", "${FORTINET.proto}", "${FORTINET.duration}", "${FORTINET.sent}", 
"${FORTINET.rcvd}", "${FORTINET.sent_pkt}", "${FORTINET.rcvd_pkt}"));
};

filter f_fortinetaccept { match("accept" value("FORTINET.status") type("string")); };
filter f_fortinetreserverd { match("Reserved" value("FORTINET.src_country") type("string")); };


parser p_fortinetaccept {
csv-parser(columns("FORTINET.timecol", 
"FORTINET.time", "FORTINET.devnamecol", "FORTINET.devname", 
"FORTINET.device_idcol", "FORTINET.device_id", "FORTINET.log_idcol", "FORTINET.log_id", 
"FORTINET.typecol", "FORTINET.type", "FORTINET.subtypecol", "FORTINET.subtype", "FORTINET.pricol", 
"FORTINET.pri", "FORTINET.vdcol", "FORTINET.vd", "FORTINET.srccol", "FORTINET.src", 
"FORTINET.src_protcol", "FORTINET.src_prot", "FORTINET.src_intcol", "FORTINET.src_int", 
"FORTINET.dstcol", "FORTINET.dst", "FORTINET.dst_portcol", "FORTINET.dst_port", 
"FORTINET.dst_intcol", "FORTINET.dst_int", "FORTINET.sncol", "FORTINET.sn", 
"FORTINET.statuscol", "FORTINET.status", "FORTINET.policyidcol", "FORTINET.policyid", 
"FORTINET.dst_countrycol", "FORTINET.dst_country", "FORTINET.src_countrycol", 
"FORTINET.src_country", "FORTINET.dir_dispcol", "FORTINET.dir_disp", 
"FORTINET.tran_dispcol", "FORTINET.tran_disp", "FORTINET.tran_ipcol", "FORTINET.tran_ip", 
"FORTINET.tran_portcol", "FORTINET.tran_port", "FORTINET.servicecol", "FORTINET.service", 
"FORTINET.protocol", "FORTINET.proto", "FORTINET.durationcol", "FORTINET.duration", 
"FORTINET.sentcol", "FORTINET.sent", "FORTINET.rcvdcol", "FORTINET.rcvd", 
"FORTINET.sentpktcol", "FORTINET.sent_pkt", "FORTINET.rcvd_pktcol", "FORTINET.rcvd_pkt")
flags(escape-double-char,strip-whitespace)
delimiters("= ")
quote-pairs('""'));
};

log { source(s_net); parser(p_fortinetaccept); filter(f_fortinetaccept); destination(d_mssql);  };

log { source(s_net); parser(p_fortinetaccept); filter(f_fortinetreserved); destination(d_mssql2);  };

答案1

我将继续尝试回答，而无需查看您的 conf 文件。当您创建新目标时，您需要添加目标和日志。以下是来自博客文章我写：

destination d_tls {
    tcp("your.logzilla.server" port(1999)
    tls( ca_dir("/etc/syslog-ng/ssl/")) );
};

log {
    source(s_src);
    destination(d_tls);
};

我的猜测是你缺少了将源和目标联系在一起的日志部分。

答案1

相关内容