安全运维 -- splunk 操作手册

0x00 背景

splunk 日常运维操作笔记。

0x01 场景

1.agent 安装

linux:

tar -zxvf splunkforwarder-8.0.3-a6754d8441bf-Linux-x86_64.tgz -C /opt

cp -r config /opt/splunkforwarder/etc/apps

vi /opt/splunkforwarder/etc/apps/prefix_app_inputs/local/inputs.conf

[monitor:///home/var/log/*log] #修改监控路径

/opt/splunkforwarder/bin/splunk start --accept-license # 输入app账号密码

/opt/splunkforwarder/bin/splunk show deploy-poll # 检查配置文件是否配置好DS指向

/opt/splunkforwarder/bin/splunk enable boot-start # 开启自启动

2.splunk接入log(读取日志文件方式)

登录DS 后台

vim /opt/splunk/etc/development-apps/prefix_all_indexes/local/indexes.conf

新增索引 [prefix_mailcasph]

[prefix_mailcasph] homePath = volume:hotwarmdb/prefix_mailcasph/db coldPath = volume:colddb/prefix_mailcasph/colddb thawedPath = $SPLUNK_DB/prefix_mailcasph/thaweddb

inputs 负责数据采集,props负责数据解析

配置inputs文件夹

vim prefix_mailcasph_inputs/local/app.conf (这个一般参考default/app.conf 不做修改)

[install]

state = enabled

[package]

check_for_updates = false

[ui]

is_visible = false

is_manageable = false

vim prefix_mailcasph_inputs/local/inputs.conf

[monitor://D:\Exchange Server\Logging\HttpProxy\Eas\HttpProxy*.log]

index = prefix_mailcasph

sourcetype = ms:exchange:http_proxy

crcSalt = <SOURCE>

disabled = false

metadata 文件夹

local.meta:[]

access = read : [ * ], write : [ admin ]

export = system

配置props文件夹

vim prefix_mailcasph_inputs/local/app.conf

[install]

state = enabled

[package]

check_for_updates = false

[ui]

is_visible = false

is_manageable = false

props.conf (来自splunk论坛某篇文章)

[ms:exchange:http_proxy]

CHARSET=UTF-8

INDEXED_EXTRACTIONS=csv

FIELD_DELIMITER=,

KV_MODE=none

SHOULD_LINEMERGE=false

disabled=false

TIMESTAMP_FIELDS=DateTime

TRANSFORMS-killheader1 = kh1

SHOULD_LINEMERGE=true

LINE_BREAKER=([\r\n]+)\d{4}\-\d{2}\-\d{2}T

TIME_PREFIX = ^

TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ

MAX_TIMESTAMP_LOOKAHEAD = 25

NO_BINARY_CHECK=true

REPORT-extractfields = extractfields

transforms.conf (来自splunk论坛某篇文章)

[kh1]

REGEX = ^DateTime

DEST_KEY = queue

FORMAT = nullQueue

[extractfields]

DELIMS=","

FIELDS=DateTime,RequestId,MajorVersion,MinorVersion,BuildVersion,RevisionVersion,ClientRequestId,Protocol,UrlHo

st,UrlStem,ProtocolAction,AuthenticationType,IsAuthenticated,AuthenticatedUser,Organization,AnchorMailbox,UserA

gent,ClientIpAddress,ServerHostName,HttpStatus,BackEndStatus,ErrorCode,Method,ProxyAction,TargetServer,TargetSe

rverVersion,RoutingType,RoutingHint,BackEndCookie,ServerLocatorHost,ServerLocatorLatency,RequestBytes,ResponseB

ytes,TargetOutstandingRequests,AuthModulePerfContext,HttpPipelineLatency,CalculateTargetBackEndLatency,GlsLaten

cyBreakup,TotalGlsLatency,AccountForestLatencyBreakup,TotalAccountForestLatency,ResourceForestLatencyBreakup,To

talResourceForestLatency,ADLatency,SharedCacheLatencyBreakup,TotalSharedCacheLatency,ActivityContextLifeTime,Mo

duleToHandlerSwitchingLatency,ClientReqStreamLatency,BackendReqInitLatency,BackendReqStreamLatency,BackendProce

ssingLatency,BackendRespInitLatency,BackendRespStreamLatency,ClientRespStreamLatency,KerberosAuthHeaderLatency,

HandlerCompletionLatency,RequestHandlerLatency,HandlerToModuleSwitchingLatency,ProxyTime,CoreLatency,RoutingLat

ency,HttpProxyOverhead,TotalRequestTime,RouteRefresherLatency,UrlQuery,BackEndGenericInfo,GenericInfo,GenericEr

rors,EdgeTraceId,DatabaseGuid,UserADObjectGuid,PartitionEndpointLookupLatency,RoutingStatus

metadata 文件夹

local.meta:[]

access = read : [ * ], write : [ admin ]

export = system

DS 下发配置到CM

CM下发配置到indexer

相关推荐
吃肉不能购27 分钟前
Label-studio-ml-backend 和YOLOV8 YOLO11自动化标注,目标检测,实例分割,图像分类,关键点估计,视频跟踪
运维·yolo·自动化
学Linux的语莫31 分钟前
Ansible使用简介和基础使用
linux·运维·服务器·nginx·云计算·ansible
qq_3129201141 分钟前
docker 部署 kvm 图形化管理工具 WebVirtMgr
运维·docker·容器
学Linux的语莫1 小时前
搭建服务器VPN,Linux客户端连接WireGuard,Windows客户端连接WireGuard
linux·运维·服务器
黑牛先生1 小时前
【Linux】进程-PCB
linux·运维·服务器
Karoku0661 小时前
【企业级分布式系统】ELK优化
运维·服务器·数据库·elk·elasticsearch
弗锐土豆2 小时前
工业生产安全-安全帽第二篇-用java语言看看opencv实现的目标检测使用过程
java·opencv·安全·检测·面部
安迁岚2 小时前
【SQL Server】华中农业大学空间数据库实验报告 实验三 数据操作
运维·服务器·数据库·sql·mysql
HackKong3 小时前
小白怎样入门网络安全?
网络·学习·安全·web安全·网络安全·黑客
打码人的日常分享3 小时前
商用密码应用安全性评估,密评整体方案,密评管理测评要求和指南,运维文档,软件项目安全设计相关文档合集(Word原件)
运维·安全·web安全·系统安全·规格说明书