diff --git a/.gitignore b/.gitignore index 602ef23..68dbac4 100644 --- a/.gitignore +++ b/.gitignore @@ -303,6 +303,7 @@ tags # Persistent undo [._]*.un~ +<<<<<<< HEAD # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and WebStorm # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 @@ -377,3 +378,11 @@ fabric.properties !/package/scripts/splunkmetrics.sh !/package/scripts/ .ecs +======= +/test-results/ +/.idea/workspace.xml +/.idea/tasks.xml +!/package/scripts/switch_transport.sh +!/package/scripts/splunkmetrics.sh +!/package/scripts/ +>>>>>>> master diff --git a/package/Dockerfile b/package/Dockerfile index a72311f..7c47a5a 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -90,6 +90,7 @@ COPY sbin/entrypoint.sh /sbin/entrypoint.sh RUN mkdir -p /opt/syslog-ng/var/data/disk-buffer RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -V RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -t +RUN mkdir -p /var/log/syslog-ng/data/disk-buffer EXPOSE 514 EXPOSE 601/tcp diff --git a/package/etc/conf.d/destinations/d_destinations.conf b/package/etc/conf.d/destinations/d_destinations.conf index 4f03b5f..6d4f9d4 100644 --- a/package/etc/conf.d/destinations/d_destinations.conf +++ b/package/etc/conf.d/destinations/d_destinations.conf @@ -49,7 +49,6 @@ destination d_hec { ); }; - destination d_hecmetrics { http( url("`SPLUNK_HEC_URL`") diff --git a/package/etc/context/splunk_index.csv b/package/etc/context/splunk_index.csv index efa7216..4446970 100644 --- a/package/etc/context/splunk_index.csv +++ b/package/etc/context/splunk_index.csv @@ -2,6 +2,7 @@ cisco:asa,index,main cisco:asa,sourcetype,cisco:asa cisco:ios,index,main cisco:ios,sourcetype,cisco:ios +<<<<<<< HEAD fgt_event,sourcetype,fgt_event fgt_event,index,main fgt_log,sourcetype,fgt_log @@ -10,6 +11,8 @@ fgt_traffic,sourcetype,fgt_traffic fgt_traffic,index,main fgt_utm,sourcetype,fgt_utm fgt_utm,index,main +======= +>>>>>>> master pan:traffic,index,main pan:threat,index,main pan:system,index,main @@ -31,4 +34,4 @@ syslog-ng:events,sourcetype,syslog-ng:events syslog-ng:fallback,index,main syslog-ng:fallback,sourcetype,syslog-ng:fallback syslog-ng:metrics,index,em_metrics -syslog-ng:metrics,sourcetype,httpevent +syslog-ng:metrics,sourcetype,httpevent \ No newline at end of file diff --git a/package/etc/syslog-ng.conf b/package/etc/syslog-ng.conf index ba0768c..a86a78d 100644 --- a/package/etc/syslog-ng.conf +++ b/package/etc/syslog-ng.conf @@ -21,6 +21,10 @@ options { chain_hostnames (off); use_dns (no); use_fqdn (no); +<<<<<<< HEAD +======= + dns-cache(no); +>>>>>>> master create_dirs (no); keep-hostname (yes); create_dirs(yes); @@ -60,10 +64,17 @@ options { # =============================================================================================== @define ip-version 4 @define splunk-max-connections 1000 +<<<<<<< HEAD @define splunk-log-fifo-size 180000000 @define splunk-fetch-limit 20000 # make sure splunk-window-size >= splunk-max-connections * splunk-fetch-limit @define splunk-window-size 20000000 +======= +@define splunk-log-fifo-size 10000 +@define splunk-fetch-limit 100 +# make sure splunk-window-size >= splunk-max-connections * splunk-fetch-limit +@define splunk-window-size 100000 +>>>>>>> master @define splunk-rcvbuf 425984 @define default-timezone "GMT"