Syslog-NG 两个中继服务器问题

Posted 2023-02-22

技术标签:

【中文标题】Syslog-NG 两个中继服务器问题【英文标题】：Syslog-NG two relay server issue 【发布时间】：2017-10-30 13:11:22 【问题描述】：

我正在尝试通过两个 syslog-ng 中继服务器转发日志，它将第一个中继服务器 IP 作为源添加，在我的 SIEM 中，我看到所有日志都来自第一个 syslog 中继服务器。

设置如下。

客户端 --> Syslog-Relay1 ---> Syslog-Relay2 ---> SIEM

在 SIEM 中，我将所有日志源视为 Syslog-Relay1。我玩过多种选择，但还没有希望。知道我在这里缺少什么吗？我没有找到任何解释此设置的适当文档/论坛。我们希望满足一些特定的日志流，以防您对我为什么要尝试实现这一点有疑问。提前致谢

以下是我的配置：

Syslog-Relay1

@version:3.5
@include "scl.conf"

# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#
# Note: it also sources additional configuration files (*.conf)
#       located in /etc/syslog-ng/conf.d/
options 
    time-reap(30);
    mark-freq(10);
#    keep-hostname(yes);
    keep-hostname(no);
    log_msg_size(65536);
    log_fifo_size(10000);
    threaded(yes);
    flush_lines(100);
    use_dns(no);
    stats_freq(60);
    mark_freq(36400);
    use_fqdn(no);
#    chain-hostnames(yes);
    chain-hostnames(no);
    ;


source s_syslog_over_network 
        network(
                ip(0.0.0.0)
                log-fetch-limit(200)
                log-iw-size(1000000)
                keep-alive(yes)
                max_connections(10000)
                port(9999)
                transport("tcp")
                flags(no-parse)
        );
;


 destination d_syslog_tcp 
       network(
                "10.12.86.98"
                transport("tcp")
                port(12229)
        );
;

log 
        source(s_syslog_over_network);
        destination(d_syslog_tcp);
;

Syslog-Relay2

@version:3.5
@include "scl.conf"

# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#
# Note: it also sources additional configuration files (*.conf)
#       located in /etc/syslog-ng/conf.d/
options 
    time-reap(30);
    mark-freq(10);
#    keep-hostname(yes);
    keep-hostname(no);
    log_msg_size(65536);
    log_fifo_size(10000);
    threaded(yes);
    flush_lines(100);
    use_dns(no);
    stats_freq(60);
    mark_freq(36400);
    use_fqdn(no);
#    chain-hostnames(yes);
    chain-hostnames(no);

    ;


source s_syslog_over_network 
        network(
                ip(0.0.0.0)
                log-fetch-limit(200)
                log-iw-size(1000000)
                keep-alive(yes)
                max_connections(10000)
                port(12229)
                transport("tcp")
               flags(no-parse)
        );
;



destination d_syslog_tcp 
        network(
                "10.12.86.76"
                transport("tcp")
                port(12221)
        );
;

log 
        source(s_syslog_over_network);
        destination(d_syslog_tcp);
;

【问题讨论】：

您好，您尝试过balabit.com/documents/syslog-ng-ose-latest-guides/en/… 和balabit.com/documents/syslog-ng-ose-latest-guides/en/… 中描述的技巧吗？是的。我确实遵循了指南，就像我说的那样，当我们介绍第二次接力时，所有问题都开始了。 【参考方案1】：

如果您想在 SIEM 中使用客户端的 IP 地址，您必须：

keep-hostname(no)

use-dns(no)