比较来自世界各地的卖家的域名和 IT 服务价格

选择一个消息 syslog-ng

我想保存原始IP地址

sshd

录制到数据库的日志 mysql 从里面

syslog-ng

. 目前,我有一个特定的过滤器与所需的日志条目的替换匹配。

我可以在数据库中完全保存日志条目

$MSG

系统日志条目部分包含我不需要的大量不必要的数据。 有没有办法“粉碎”录制系统日志的字段只是在数据库中记录IP地址?

这是我的配置:

filter f_sshd
{
# (log entry) Sep 5 14:59:20 myhost4 sshd Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0
match("Starting session:" value ("MESSAGE") );
};


destination d_sshd
{
sql( type(mysql)
username("xxxxx")
password("xxxxxxx")
database("syslog")
host("localhost")
table("ssh")
columns("host", "facility", "priority", "level", "pid", "tag", "timestamp", "program", "msg")
values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$PID", "$TAG","$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC","$PROGRAM", "$MSG")
indexes("timestamp", "host", "program", "pid", "message"));
};

log
{
# s_stunnel is defined in syslog-ng/conf.d/stunnel.conf
source(s_stunnel);
filter(f_sshd);
destination(d_sshd);
};
已邀请:

裸奔

赞同来自:

您可以使用ARSER使用
https://github.com/balabit/syslog-ng-patterndb
提取消息部件。

创建文件。 XML 确定你的解析器 (

/etc/syslog-ng/template_sshd.xml

):

<patterndb pub_date="2010-10-17" version="4">
<ruleset id="123456678" name="ssh">
<pattern>ssh</pattern>
<rules>
<rule class="system" id="182437592347598" provider="me">
<patterns>
<pattern>Starting session: shell on @ESTRING:SSH_TERMINAL: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ id @NUMBER:SSH_ID@</pattern>
</patterns>
<examples>
<example>
<test_message program="ssh">Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0</test_message>
<test_values>
<test_value name="SSH_TERMINAL">pts/0</test_value>
<test_value name="SSH_USERNAME">sampleuser</test_value>
<test_value name="SSH_CLIENT_ADDRESS">192.168.10.12</test_value>
<test_value name="SSH_PORT_NUMBER">42156</test_value>
<test_value name="SSH_ID">1</test_value>
</test_values>
</example>
</examples>
</rule>
</rules>
</ruleset>
</patterndb>

然后在你的中

syslog-ng.conf

:

确定解析器:

parser sshd_pattern { db_parser(file("/etc/syslog-ng/template_sshd.xml")); };

将解析器致电其杂志指令:

log
{
# s_stunnel is defined in syslog-ng/conf.d/stunnel.conf
source(s_stunnel);
parser(sshd_pattern); <---- call parser
filter(f_sshd);
destination(d_sshd);
};

使用变量

SSH_CLIENT_ADDRESS

从您的目的地的解析器:

destination d_sshd
{
file("/var/log/sshd.log"
template("${SSH_USERNAME}; ${SSH_CLIENT_ADDRESS}; ${HOST}; ${FACILITY}; ${PRIORITY}; ${LEVEL}; ${PID}; ${TAG}; ${YEAR}-${MONTH}-${DAY} ${HOUR}:${MIN}:${SEC}; ${PROGRAM}; \n")
template_escape(no)
);
};

运行模块化测试:

pdbtool match -P "ssh" -M "Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0" -p template_sshd.xml -c -D -v

必须回来:

SSH_TERMINAL=pts/0
SSH_USERNAME=rbackup
SSH_CLIENT_ADDRESS=10.120.192.25
SSH_PORT_NUMBER=36894
SSH_ID=0

通过此链接调整:
https://gist.github.com/linickx/8002981
编辑以下评论:

理想情况下是钥匙 SSH_TERMINAL 他可以在会议后从空间吞下一切:从赤裸的话语

改变模板B. XML 通过以下方式:

<pattern>Starting session: @ESTRING:SSH_TERMINAL:from @@ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ id @NUMBER:SSH_ID@</pattern>

什么回报:

# pdbtool match -P "ssh" -M "Starting session: shell on pts/0 for rbackup from 10.120.192.25 port 36894 id 0" -p template_sshd.xml -c -D -v

SSH_TERMINAL=shell on pts/0 for rbackup <-- you got all between "session:" to "from"
SSH_CLIENT_ADDRESS=10.120.192.25
SSH_PORT_NUMBER=36894
SSH_ID=0

有关Parses模板的其他信息:
https://www.syslog-ng.com/tech ... de/72

要回复问题请先登录注册