1,网络设备日志客户端配置举例
深信服防火墙日志传入ELK:ELK的IP地址和端口
深信服行为管理日志存入ELK:设备的【系统管理】-【系统配置】-【高级配置】-【外部syslog服务器】里面配置syslog服务器的地址和选择需要看的日志选项。注意仅填写ELK的IP地址
无线控制器:找到日志配置,一般填写ELK的IP即可,默认514端口。
交换机的日志:dis cu | inc info
info-center loghost 192.168.112.133,此IP是ELK地址,默认是UDP514端口发送数据
ELK服务端:客户端514转发过来的重定向到5044logstash
systemctl stop rsyslog
iptables -t nat -A PREROUTING -p tcp --dport 514 -j REDIRECT --to 5044
iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to 5044
mkdir /data/elk/logstash/conf.d
vi /data/elk/logstash/conf.d/switch.conf
input{
tcp { port => 5002
type => "Cisco"}
udp { port => 514
type => "HUAWEI"}
udp { port => 5002
type => "Cisco"}
udp { port => 5003
type => "H3C"}
}
filter {
if [type] == "Cisco" {
grok {
match => { "message" => "<%{BASE10NUM:syslog_pri}>%{NUMBER:log_sequence}: .%{SYSLOGTIMESTAMP:timestamp}: %%{DATA:facility}-%{POSINT:severity}-%{CISCO_REASON:mnemonic}: %{GREEDYDATA:message}" }
match => { "message" => "<%{BASE10NUM:syslog_pri}>%{NUMBER:log_sequence}: %{SYSLOGTIMESTAMP:timestamp}: %%{DATA:facility}-%{POSINT:severity}-%{CISCO_REASON:mnemonic}: %{GREEDYDATA:message}" }
add_field => {"severity_code" => "%{severity}"}
overwrite => ["message"]
}
}
elseif [type] == "H3C" {
grok {
match => { "message" => "<%{BASE10NUM:syslog_pri}>%{SYSLOGTIMESTAMP:timestamp} %{YEAR:year} %{DATA:hostname} %%%{DATA:vvmodule}/%{POSINT:severity}/%{DATA:digest}: %{GREEDYDATA:message}" }
remove_field => [ "year" ]
add_field => {"severity_code" => "%{severity}"}
overwrite => ["message"]
}
}
elseif [type] == "HUAWEI" {
grok {
match => { "message" => "<%{BASE10NUM:syslog_pri}>%{SYSLOGTIMESTAMP:timestamp} %{DATA:hostname} %%%{DATA:ddModuleName}/%{POSINT:severity}/%{DATA:Brief}:%{GREEDYDATA:message}"}
match => { "message" => "<%{BASE10NUM:syslog_pri}>%{SYSLOGTIMESTAMP:timestamp} %{DATA:hostname} %{DATA:ddModuleName}/%{POSINT:severity}/%{DATA:Brief}:%{GREEDYDATA:message}"}
remove_field => [ "timestamp" ]
add_field => {"severity_code" => "%{severity}"}
overwrite => ["message"]
}
}
mutate {
gsub => [
"severity", "0", "Emergency",
"severity", "1", "Alert",
"severity", "2", "Critical",
"severity", "3", "Error",
"severity", "4", "Warning",
"severity", "5", "Notice",
"severity", "6", "Informational",
"severity", "7", "Debug"
]
}
}
output{
stdout {#将日志输出到当前终端上显示
codec => rubydebug
}
elasticsearch {
index =>
"syslog-%{+YYYY.MM.dd}"
hosts => ["172.16.200.10:9200"]
}
}
日志时间不对的,需要终端交换机上修改时区。
2,linux默认rsyslog配置举例
vi /etc/rsyslog.conf
*.* @172.16.5.106:5044;RSYSLOG_SyslogProtocol23Format #*.* 代表linux中所有模块所有级别的日志,@代表使用udp协议,@@代表使用tcp协议greylog主机的IP和收集端口#RSYSLOG_SyslogProtocol23Format 代表syslog协议格式模板
systemctl restart rsyslog
systemctl enable rsyslog
ps aux | grep "rsyslog" | grep -v "grep"
systemctl list-unit-files rsyslog.service
3,windows日志举例
安装winbeat客户端,启用服务,配置指向ELK