{"id":7428,"date":"2022-04-22T14:33:18","date_gmt":"2022-04-22T21:33:18","guid":{"rendered":"https:\/\/www.xh86.me\/?p=7428"},"modified":"2022-04-22T14:33:18","modified_gmt":"2022-04-22T21:33:18","slug":"linux%e4%b8%bb%e6%9c%ba%e5%ae%89%e8%a3%85netflow%e9%87%87%e9%9b%86%e5%99%a8%e5%b9%b6%e4%bd%bf%e7%94%a8graylog%e8%bf%9b%e8%a1%8c%e7%bd%91%e7%bb%9c%e6%b5%81%e9%87%8f%e5%88%86%e6%9e%90","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=7428","title":{"rendered":"Linux\u4e3b\u673a\u5b89\u88c5NetFlow\u91c7\u96c6\u5668\u5e76\u4f7f\u7528Graylog\u8fdb\u884c\u7f51\u7edc\u6d41\u91cf\u5206\u6790"},"content":{"rendered":"
\n

\n

<\/section>\n
\n

Linux\u4e3b\u673a\u5b89\u88c5NetFlow\u91c7\u96c6\u5668\u5e76\u4f7f\u7528Graylog\u8fdb\u884c\u7f51\u7edc\u6d41\u91cf\u5206\u6790<\/span><\/h1>\n

\u8fd9\u7bc7GrayLog\u5927\u4f6c\u6587\u7ae0\u540e\u91c7\u7528softflowd<\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u4f7f\u7528softflowd\u53d1\u9001Netflow\u65e5\u5fd7\u5230Graylog<\/p>\n

\u5177\u4f53\u6b65\u9aa4\u5982\u4e0b<\/p>\n

1\u3001\u4e0b\u8f7dsoftflowd\u6e90\u7801\u5305<\/span><\/h2>\n
https:\/\/storage.googleapis.com\/google-code-archive-downloads\/v2\/code.google.com\/softflowd\/softflowd-0.9.9.tar.gz\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
2\u3001\u5b89\u88c5libpcap-devel\u73af\u5883<\/span><\/h2>\n
yum\u00a0install\u00a0libpcap-devel\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
3\u3001\u7f16\u8bd1\u5e76\u5b89\u88c5softflowd<\/span><\/h2>\n
tar\u00a0-xvf\u00a0softflowd-0.9.9.tar.gz\r\ncd<\/span>\u00a0softflowd-0.9.9\r\n.\/configure\u00a0\r\nmake\r\nmake\u00a0install\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
4\u3001\u53ef\u4ee5\u67e5\u770bsoftflowd\u7684\u7528\u6cd5<\/span><\/h2>\n
man\u00a0softflowd\r\n<\/code><\/pre>\n
5\u3001\u8fd0\u884csoftflowd<\/span><\/h2>\n
softflowd\u00a0-v\u00a09\u00a0-D\u00a0-i\u00a0ens33\u00a0-t\u00a0maxlife=1\u00a0-n\u00a0192.168.31.127:2055\u00a0>\/dev\/null\u00a02>&1\u00a0&<\/span>\r\n<\/code><\/pre>\n
-i \u6307\u5b9a\u91c7\u96c6\u7684\u7f51\u5361<\/p>\n
-D debug\u6a21\u5f0f<\/p>\n
-n \u8f93\u51fa\u5230\u6307\u5b9a\u7684IP\u548c\u7aef\u53e3<\/p>\n
-v \u6307\u5b9anetflow\u534f\u8bae\u7248\u672c<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u8bf4\u660e\uff1a\u5982\u679c\u8981\u540e\u53f0\u8fd0\u884c<\/p>\n
nohup\u00a0softflowd\u00a0-v\u00a09\u00a0-D\u00a0-i\u00a0ens33\u00a0-t\u00a0maxlife=1\u00a0-n\u00a0192.168.31.127:2055\u00a0>\/dev\/null\u00a02>&1\u00a0&\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
6\u3001GrayLog\u6dfb\u52a0Netflow\u7684Input<\/span><\/h2>\n
\u6dfb\u52a0\u7c7b\u578b\u4e3aNetflow UDP\u7684Input\uff0c\u7aef\u53e3\u8fd9\u91cc\u75282055<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u7136\u540e\u9632\u706b\u5899\u4e0a\u5f00\u653e2055 UDP\u7aef\u53e3<\/p>\n
firewall-cmd\u00a0--permanent\u00a0--zone=public\u00a0--add-port=2055\/udp\r\nfirewall-cmd\u00a0--reload\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
7\u3001GrayLog\u4e0a\u67e5\u770bNetflow\u65e5\u5fd7<\/span><\/h2>\n
\u914d\u7f6eNetflow\u5bf9\u5e94\u7684Indices\u548cStream\u8fd9\u91cc\u5c31\u4e0d\u8be6\u7ec6\u63cf\u8ff0<\/p>\n
\u4ee5\u53ca\u5f00\u542fGeoIP\u67e5\u8be2<\/p>\n
\u914d\u7f6e\u4e0b\u663e\u793a\u7684\u5b57\u6bb5<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u6548\u679c\u5982\u4e0b<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Linux\u4e3b\u673a\u5b89\u88c5NetFlow\u91c7\u96c6\u5668\u5e76\u4f7f\u7528Graylog\u8fdb\u884c\u7f51\u7edc\u6d41\u91cf\u5206\u6790 \u8fd9\u7bc7GrayLog\u5927\u4f6c\u6587\u7ae0\u540e\u91c7\u7528s […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,3],"tags":[],"class_list":["post-7428","post","type-post","status-publish","format-standard","hentry","category-linux","category-system"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7428"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7428\/revisions"}],"predecessor-version":[{"id":7807,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7428\/revisions\/7807"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}