多个输入用于单一规则集(在单一位置进行过滤/丢弃)

huangapple go评论55阅读模式
英文:

Multiple Inputs for Single Rule Set (Filtering/dropping in a single location)

问题

我们正在尝试将单个过滤器 "0_MasterFilter.conf" 应用于所有已配置的监听端口上进入的具有特定IP和主机名的所有消息,以减少管理开销。

我们试图仅使用一个规则集 "rsyslog_rules"。然后为所有不同的监听端口设置多个输入。以下内容是否有效?还是有更好的方法?

0_MasterFilter.conf

    if $fromhost starts with 'bilbo' or $fromhost-ip == '0.1.1.1' then { stop }
}

1_Port514.conf

    if $fromhost starts with 'testbox' or $fromhost-ip == '0.2.2.2' then { stop }
    set $!dev='syslog_server'
    set $!loc='net1'
    action (type="omfile" dynafile="514_serverX")
}
input (type="imptcp" port="514" ruleset="rsyslog_rules")
input (type="impudp" port="514" ruleset="rsyslog_rules")

2_Port600.conf

    if $fromhost starts with 'lost' or $fromhost-ip == '0.3.3.3' then { stop }
    set $!dev='dum_machine'
    set $!loc='backroom'
    action (type="omfile" dynafile="600_test")
}
input (type="imptcp" port="600" ruleset="rsyslog_rules")
英文:

We're attempting to apply a single filter "0_MasterFilter.conf" to filter/drop all messages with certain IP's and hostnames coming in on ALL configured listening ports, in a single location, in order to reduce administrative overhead.

We're attempting to use a single ruleset "rsyslog_rules" only. Then have multiple inputs for all of the different listening ports. Will the following work? Or is there a better way?

0_MasterFilter.conf

ruleset (name=rsyslog_rules) {
    if $fromhost starts with 'bilbo' or $fromhost-ip == '0.1.1.1' then { stop }
}

1_Port514.conf

ruleset (name=rsyslog_rules) {
    if $fromhost starts with 'testbox' or $fromhost-ip == '0.2.2.2' then { stop }
    set $!dev='syslog_server'
    set $!loc='net1'
    action (type="omfile" dynafile="514_serverX")
}
input (type="imptcp" port="514" ruleset="rsyslog_rules")
input (type="impudp" port="514" ruleset="rsyslog_rules")

2_Port600.conf

ruleset (name=rsyslog_rules) {
    if $fromhost starts with 'lost' or $fromhost-ip == '0.3.3.3' then { stop }
    set $!dev='dum_machine'
    set $!loc='backroom'
    action (type="omfile" dynafile="600_test")
}
input (type="imptcp" port="600" ruleset="rsyslog_rules")

答案1

得分: 0

以下是翻译好的内容:

你不能多次定义一个规则集,所以 ruleset(name="rsyslog_rules"){...} 只能出现一次。注意名称必须用引号括起来。另外,starts with 是一个词。可以使用 rsyslogd -N1 -f myconfig.conf 进行语法检查。

如果你想要有一组适用于所有输入的规则,但也有一些只适用于某些输入的个别规则,那么你可以将所有共同的规则放在一个规则集中,并将一个新的独立规则集绑定到每个输入,但从这些独立规则集中调用共同的规则集。例如:

0_MasterFilter.conf

ruleset (name="rsyslog_rules") {
    if $fromhost starts with 'bilbo' or $fromhost-ip == '0.1.1.1' then { stop }
}

1_Port514.conf

ruleset (name="special1") {
    call rsyslog_rules
    if $fromhost starts with 'testbox' or $fromhost-ip == '0.2.2.2' then { stop }
    set $!dev='syslog_server'
    set $!loc='net1'
    action (type="omfile" dynafile="514_serverX")
}
input (type="imptcp" port="514" ruleset="special1")
input (type="impudp" port="514" ruleset="special1")

call 命令可以在规则集中的任何地方使用。请注意,名称不需要放在引号中。

英文:

You cannot define a ruleset more than once, so ruleset(name="rsyslog_rules"){...} can only appear once. Note that the name must be in quotes. Also starts with is one word. Do a syntax check with rsyslogd -N1 -f myconfig.conf.


If you want to have a set of rules that apply to all inputs, but also have
individual rules that only apply to some of the inputs, then you can put
all the common rules in one ruleset, and bind a new independent ruleset to
each input, but call the common ruleset from these independent rulesets.
For example:

0_MasterFilter.conf

ruleset (name="rsyslog_rules") {
    if $fromhost starts with 'bilbo' or $fromhost-ip == '0.1.1.1' then { stop }
}

1_Port514.conf

ruleset (name="special1") {
    call rsyslog_rules
    if $fromhost starts with 'testbox' or $fromhost-ip == '0.2.2.2' then { stop }
    set $!dev='syslog_server'
    set $!loc='net1'
    action (type="omfile" dynafile="514_serverX")
}
input (type="imptcp" port="514" ruleset="special1")
input (type="impudp" port="514" ruleset="special1")

The call command can be given anywhere in a ruleset. Note that the name
is not put in quotes ("").

huangapple
  • 本文由 发表于 2023年2月10日 03:35:43
  • 转载请务必保留本文链接:https://go.coder-hub.com/75403599.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定