{"id":7596,"date":"2022-04-22T14:47:27","date_gmt":"2022-04-22T21:47:27","guid":{"rendered":"https:\/\/www.xh86.me\/?p=7596"},"modified":"2022-04-22T14:47:27","modified_gmt":"2022-04-22T21:47:27","slug":"nginx%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e6%8e%a5%e5%85%a5graylog4-2-5%e5%b9%b6%e9%80%9a%e8%bf%87geoip%e5%b1%95%e7%8e%b0%e8%ae%bf%e9%97%ae%e8%80%85ip%e7%9a%84%e5%9c%b0%e7%90%86%e4%bd%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=7596","title":{"rendered":"Nginx\u8bbf\u95ee\u65e5\u5fd7\u63a5\u5165GrayLog4.2.5\u5e76\u901a\u8fc7GeoIP\u5c55\u73b0\u8bbf\u95ee\u8005IP\u7684\u5730\u7406\u4f4d\u7f6e\u4fe1\u606f"},"content":{"rendered":"
\n

Nginx\u8bbf\u95ee\u65e5\u5fd7\u63a5\u5165GrayLog4.2.5\u5e76\u901a\u8fc7GeoIP\u5c55\u73b0\u8bbf\u95ee\u8005IP\u7684\u5730\u7406\u4f4d\u7f6e\u4fe1\u606f<\/span><\/p>\n

\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u914d\u7f6e\u6b65\u9aa4<\/strong><\/span><\/p>\n

1\u3001maxmind\u5b98\u7f51\u4e0b\u8f7dGeoLite2-City\u7684mmdb\u6587\u4ef6<\/span><\/h2>\n

https:\/\/www.maxmind.com\/<\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u4e0a\u4f20\/etc\/graylog\/server\u76ee\u5f55\u4e2d<\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u5e76\u5728\u914d\u7f6e\u4e2d\u542f\u7528\uff0c\u4ee5\u53ca\u4fee\u6539Message Processors\u914d\u7f6e\u4e2d\u7684\u987a\u5e8f\u00a0<\/span><\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

2\u3001Graylog\u5347\u7ea7\u81f3\u6700\u65b0\u7248\u672c<\/span><\/h2>\n
rpm\u00a0-aq\u00a0|\u00a0grep\u00a0graylog-server\r\nyum\u00a0update\u00a0graylog-server\u00a0-y\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u56e0\u4e3a\u6240\u4f7f\u7528graylog-content-pack-nginx-syslog\u8981\u6c424.2.5\u4ee5\u4e0a\u7248\u672c \u5347\u7ea7\u5b8c\u6210\u540e\u91cd\u542f\u670d\u52a1<\/span><\/p>\n
systemctl\u00a0restart\u00a0graylog-server\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
3\u3001\u4e0b\u8f7dgraylog-content-pack-nginx-syslog<\/span><\/h2>\n
https:\/\/github.com\/scriptingislife\/graylog-content-pack-nginx-syslog<\/p>\n
\u4fee\u6539\u4e3a1515\u7aef\u53e3\u4f5c\u4e3asyslog input\u63a5\u6536\u7aef\u53e3\u5e76\u5bfc\u5165<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u70b9\u51fbinstall\u540e<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u53ef\u4ee5\u5728Input\u4e2d\u770b\u5230nginx-syslog 1515\u7aef\u53e3\u7684\u4e00\u4e2ainput<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u5148\u542f\u7528input<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u8fd9\u65f6\u82e5GrayLog\u7684\u9632\u706b\u5899\u6ca1\u6709\u5f00\u653e1515 udp\u7aef\u53e3\uff0c\u5219\u9700\u8981\u5f00\u653e\u4e00\u4e0b<\/p>\n
firewall-cmd\u00a0--permanent\u00a0--zone=public\u00a0--add-port=1515\/udp\r\nfirewall-cmd\u00a0--reload\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
4\u3001nginx\u670d\u52a1\u5668\u4e0a\u4fee\u6539nginx.conf\u914d\u7f6e\u6587\u4ef6<\/span><\/h2>\n
\u00a0\u00a0\u00a0\u00a0log_format\u00a0graylog_json\u00a0escape=json\u00a0'{\u00a0\"nginx_timestamp\":\u00a0\"$time_iso8601\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"remote_addr\":\u00a0\"$remote_addr\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"connection\":\u00a0\"$connection\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"connection_requests\":\u00a0$connection_requests,\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"pipe\":\u00a0\"$pipe\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"body_bytes_sent\":\u00a0$body_bytes_sent,\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"request_length\":\u00a0$request_length,\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"request_time\":\u00a0$request_time,\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"response_status\":\u00a0$status,\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"request\":\u00a0\"$request\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"request_method\":\u00a0\"$request_method\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"host\":\u00a0\"$host\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"upstream_cache_status\":\u00a0\"$upstream_cache_status\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"upstream_addr\":\u00a0\"$upstream_addr\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"http_x_forwarded_for\":\u00a0\"$http_x_forwarded_for\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"http_referrer\":\u00a0\"$http_referer\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"http_user_agent\":\u00a0\"$http_user_agent\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"http_version\":\u00a0\"$server_protocol\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"remote_user\":\u00a0\"$remote_user\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"http_x_forwarded_proto\":\u00a0\"$http_x_forwarded_proto\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"upstream_response_time\":\u00a0\"$upstream_response_time\",\u00a0'<\/span>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'\"nginx_access\":\u00a0true\u00a0}'<\/span>;<\/code><\/pre>\n
access_log\u00a0syslog:server=192.168.31.127:1515\u00a0graylog_json;
\naccess_log\u00a0\/var\/log<\/span>\/nginx\/access.log\u00a0main\u00a0;
\nerror_log\u00a0\u00a0\/var\/log<\/span>\/nginx\/error.log;<\/p>\n
<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u7136\u540e\u91cd\u542fnginx\u670d\u52a1<\/p>\n
<\/div><\/p>\n
5\u3001Graylog\u4e0a\u53ef\u4ee5\u67e5\u8be2\u5230\u8be5nginxserver\u7684\u65e5\u5fd7<\/span><\/h2>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u53ef\u4ee5\u770b\u51fa\u5df2\u7ecf\u62c6\u89e3\u6210\u4e86\u76f8\u5e94\u7684\u5b57\u6bb5<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
6\u3001\u6a21\u62df\u516c\u7f51IP\u8bbf\u95eenginx webserver<\/span><\/h2>\n
\u8fd9\u65f6\u82e5\u80fd\u5339\u914d\u5230GeoIP\uff0c\u5219\u4f1a\u6709\u5982\u4e0bGEO\u76f8\u5173\u5b57\u6bb5<\/p>\n
<\/div><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
7\u3001\u914d\u7f6eWorldMap<\/span><\/h2>\n
Field:remote_addr_geolocation<\/code><\/pre>\n
Type:World\u00a0Map<\/p>\n
<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
8\u3001GEO MAP\u6548\u679c\u5982\u4e0b<\/span><\/h2>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u672c\u6587\u53c2\u8003\u5982\u4e0b\u94fe\u63a5\u5b8c\u6210<\/p>\n
1\u3001https:\/\/zhuanlan.zhihu.com\/p\/113755052\r\n2\u3001https:\/\/www.graylog.org\/post\/how-to-set-up-graylog-geoip-configuration\r\n3\u3001https:\/\/scriptingis.life\/NGINX-Syslog-Graylog\/\r\n4\u3001https:\/\/github.com\/scriptingislife\/graylog-content-pack-nginx-syslog\r\n5\u3001https:\/\/cloud.tencent.com\/developer\/article\/1690193<\/code><\/pre>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Nginx\u8bbf\u95ee\u65e5\u5fd7\u63a5\u5165GrayLog4.2.5\u5e76\u901a\u8fc7GeoIP\u5c55\u73b0\u8bbf\u95ee\u8005IP\u7684\u5730\u7406\u4f4d\u7f6e\u4fe1\u606f (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,3],"tags":[],"class_list":["post-7596","post","type-post","status-publish","format-standard","hentry","category-linux","category-system"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7596"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7596\/revisions"}],"predecessor-version":[{"id":7828,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7596\/revisions\/7828"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7596"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7596"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}