From 27c6332feac922fceea070e62ee834c5b05f119b Mon Sep 17 00:00:00 2001 From: Ryan Faircloth <35384120+rfaircloth-splunk@users.noreply.github.com> Date: Mon, 23 Sep 2019 08:37:14 -0400 Subject: [PATCH 1/4] Feature/fixupstream (#89) * Release/0.4.0 (#67) v0.4.0 - Add source support for Cisco NX - Add source support for Symantec Proxy SG and ASG (Formerly bluecoat) - Add support for mapping network source IP OR parsed host to specific vendor product where MSG parsing is impossible - Code cleanup and simplification - Begin using SEMVER for releases * Update CONTRIBUTING.md (#74) * Update gettingstarted.md (#73) Adding base system spec * Release/0.5.0 (#86) * New documentation for podman, docker and swarm! * Support for trusted certs for Splunk * Support for product specific TCP/UDP listeners * Change to 3.23.1 tag fixed --- .gitmodules | 2 ++ package/etc/syslog-ng.conf | 2 +- package/syslog-ng | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitmodules b/.gitmodules index 8f7d5ba..61760d8 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,5 @@ [submodule "package/syslog-ng"] path = package/syslog-ng url = https://github.com/balabit/syslog-ng.git +[submodule "Submod"] + branch = syslog-ng-3.23.1 diff --git a/package/etc/syslog-ng.conf b/package/etc/syslog-ng.conf index edee26f..ca63a34 100644 --- a/package/etc/syslog-ng.conf +++ b/package/etc/syslog-ng.conf @@ -1,4 +1,4 @@ -@version:3.22 +@version:3.23 # syslog-ng configuration file. # diff --git a/package/syslog-ng b/package/syslog-ng index 1742b11..08b33b7 160000 --- a/package/syslog-ng +++ b/package/syslog-ng @@ -1 +1 @@ -Subproject commit 1742b11e5cfa6544ece38aaecde96e9b423d61c5 +Subproject commit 08b33b7860734526d65f0e827f092dc5ca3c7ff8 From 3def0e09948cb655cf4e53377cc75063c8776a30 Mon Sep 17 00:00:00 2001 From: Ryan Faircloth <35384120+rfaircloth-splunk@users.noreply.github.com> Date: Mon, 23 Sep 2019 10:46:32 -0400 Subject: [PATCH 2/4] Add port paths (#90) --- package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf | 10 +++++++++- package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf | 10 +++++++++- .../etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf | 10 +++++++++- .../conf.d/log_paths/p_rfc3164-fortinet_fortios.conf | 10 +++++++++- .../log_paths/p_rfc5424_noversion-cisco_asa.conf | 10 +++++++++- .../log_paths/p_rfc_5424_noversion-symantec_proxy.conf | 9 ++++++++- .../log_paths/p_rfc_5424_strict-juniper_junos.conf | 9 ++++++++- 7 files changed, 61 insertions(+), 7 deletions(-) diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf index f97b906..ab1dda1 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf @@ -10,4 +10,12 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; + +log { + #Default source + gen_log_rfc_3164-cisco-asa( + sourcedefault(no) + ); + +}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf index 2f7a3bb..44bd40f 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf @@ -11,4 +11,12 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; + +log { + #Default source + gen_log_rfc_3164-cisco-ios( + sourcedefault(no) + ); + +}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf index 04297c6..5e98035 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf @@ -11,4 +11,12 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; + +log { + #Default source + gen_log_rfc_3164-cisco-nx-os( + sourcedefault(no) + ); + +}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf index c22dceb..5ee38f6 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf @@ -11,4 +11,12 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; + +log { + #Default source + gen_log_rfc_3164-fortigate-fortios( + sourcedefault(no) + ); + +}; diff --git a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf index 55d4463..eff1858 100644 --- a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf +++ b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf @@ -11,4 +11,12 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; + +log { + #Default source + gen_log_rfc_5424_noversion-cisco-asa( + sourcedefault(no) + ); + +}; diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf index d701ba5..cc380fe 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf +++ b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf @@ -7,4 +7,11 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; +log { + #Default source + gen_log_rfc_5424_noversion-symantec_proxy( + sourcedefault(no) + ); + +}; diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf index 48365ea..e126b85 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf +++ b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf @@ -11,4 +11,11 @@ log { sourcedefault(yes) ); -}; \ No newline at end of file +}; +log { + #Default source + gen_log_rfc_5424_strict-juniper_junos( + sourcedefault(no) + ); + +}; From 6079206a6a2e1231f9cad7aeb045b50cfc511140 Mon Sep 17 00:00:00 2001 From: Ryan Faircloth <35384120+rfaircloth-splunk@users.noreply.github.com> Date: Wed, 25 Sep 2019 06:39:04 -0400 Subject: [PATCH 3/4] Feature/precompile templates (#91) Replace confgen with the use of a entry point step which will convert tmpl files to conf files and replace the use of "blocks" with generated named config section to improve metrics --- package/Dockerfile | 7 +- .../etc/conf.d/conflib/_common/network.conf | 10 -- .../conf.d/conflib/_common/network.conf.tmpl | 93 ------------------- .../etc/conf.d/destinations/splunk_hec.conf | 5 - .../conf.d/destinations/splunk_hec.conf.tmpl | 49 +++++----- .../destinations/splunk_hec_internal.conf | 5 - .../splunk_hec_internal.conf.tmpl | 31 ++++--- .../destinations/splunk_hec_metrics.conf | 6 -- .../destinations/splunk_hec_metrics.conf.tmpl | 21 +++-- package/etc/conf.d/destinations/stdout.conf | 6 -- .../etc/conf.d/destinations/stdout.conf.tmpl | 4 +- .../vendor_cisco => filters/cisco}/asa.conf | 0 .../vendor_cisco => filters/cisco}/ios.conf | 0 .../vendor_cisco => filters/cisco}/nx-os.conf | 0 .../fortinet}/fortios.conf | 0 .../juniper}/junos.conf | 0 .../juniper}/legacy.conf | 0 .../paloalto}/panos.conf | 0 .../symantec}/bluecoat_proxy.conf | 0 package/etc/conf.d/log_paths/internal.conf | 9 -- .../etc/conf.d/log_paths/internal.conf.tmpl | 13 ++- .../conf.d/log_paths/p_rfc3164-cisco_asa.conf | 21 ----- .../log_paths/p_rfc3164-cisco_asa.conf.tmpl | 39 ++++---- .../conf.d/log_paths/p_rfc3164-cisco_ios.conf | 22 ----- .../log_paths/p_rfc3164-cisco_ios.conf.tmpl | 35 ++++--- .../log_paths/p_rfc3164-cisco_nx-os.conf | 22 ----- .../log_paths/p_rfc3164-cisco_nx-os.conf.tmpl | 35 ++++--- .../log_paths/p_rfc3164-fortinet_fortios.conf | 22 ----- .../p_rfc3164-fortinet_fortios.conf.tmpl | 40 ++++---- .../log_paths/p_rfc3164-juniper_idp.conf | 17 ---- .../log_paths/p_rfc3164-juniper_idp.conf.tmpl | 34 ++++--- .../log_paths/p_rfc3164-juniper_junos.conf | 17 ---- .../p_rfc3164-juniper_junos.conf.tmpl | 35 ++++--- .../p_rfc3164-juniper_netscreen.conf | 17 ---- .../p_rfc3164-juniper_netscreen.conf.tmpl | 34 ++++--- .../log_paths/p_rfc3164-juniper_nsm.conf | 21 ----- .../log_paths/p_rfc3164-juniper_nsm.conf.tmpl | 34 ++++--- .../log_paths/p_rfc3164-juniper_nsm_idp.conf | 21 ----- .../p_rfc3164-juniper_nsm_idp.conf.tmpl | 34 ++++--- .../log_paths/p_rfc3164-paloalto_panos.conf | 17 ---- .../p_rfc3164-paloalto_panos.conf.tmpl | 47 ++++++---- .../p_rfc5424_noversion-cisco_asa.conf | 22 ----- .../p_rfc5424_noversion-cisco_asa.conf.tmpl | 38 ++++---- .../p_rfc_5424_noversion-symantec_proxy.conf | 17 ---- ...fc_5424_noversion-symantec_proxy.conf.tmpl | 38 ++++---- .../p_rfc_5424_strict-juniper_junos.conf | 21 ----- .../p_rfc_5424_strict-juniper_junos.conf.tmpl | 36 ++++--- package/etc/conf.d/sources/network.conf | 6 -- package/etc/conf.d/sources/network.conf.tmpl | 12 ++- package/etc/syslog-ng.conf | 8 +- package/etc/templates/source_network.t | 86 +++++++++++++++++ package/sbin/entrypoint.sh | 15 +++ package/syslog-ng | 2 +- tests/test_cisco_asa.py | 2 +- tests/test_juniper_legacy.py | 2 +- 55 files changed, 474 insertions(+), 654 deletions(-) delete mode 100644 package/etc/conf.d/conflib/_common/network.conf delete mode 100644 package/etc/conf.d/destinations/splunk_hec.conf delete mode 100644 package/etc/conf.d/destinations/splunk_hec_internal.conf delete mode 100644 package/etc/conf.d/destinations/splunk_hec_metrics.conf delete mode 100644 package/etc/conf.d/destinations/stdout.conf rename package/etc/conf.d/{conflib/vendor_cisco => filters/cisco}/asa.conf (100%) rename package/etc/conf.d/{conflib/vendor_cisco => filters/cisco}/ios.conf (100%) rename package/etc/conf.d/{conflib/vendor_cisco => filters/cisco}/nx-os.conf (100%) rename package/etc/conf.d/{conflib/vendor_fortinet => filters/fortinet}/fortios.conf (100%) rename package/etc/conf.d/{conflib/vendor_juniper => filters/juniper}/junos.conf (100%) rename package/etc/conf.d/{conflib/vendor_juniper => filters/juniper}/legacy.conf (100%) rename package/etc/conf.d/{conflib/vendor_pan => filters/paloalto}/panos.conf (100%) rename package/etc/conf.d/{conflib/vendor_symantec => filters/symantec}/bluecoat_proxy.conf (100%) delete mode 100644 package/etc/conf.d/log_paths/internal.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf delete mode 100644 package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf delete mode 100644 package/etc/conf.d/sources/network.conf create mode 100644 package/etc/templates/source_network.t create mode 100755 package/sbin/entrypoint.sh diff --git a/package/Dockerfile b/package/Dockerfile index 091e2cb..3144c60 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -86,11 +86,12 @@ RUN curl -o /usr/local/bin/gomplate -sSL https://github.com/hairyhenderson/gompl COPY etc/syslog-ng.conf /opt/syslog-ng/etc/syslog-ng.conf COPY etc/conf.d /opt/syslog-ng/etc/conf.d +COPY etc/templates /opt/syslog-ng/etc/templates COPY etc/context-local /opt/syslog-ng/etc/context-local - +COPY sbin/entrypoint.sh / RUN mkdir -p /opt/syslog-ng/var/data/disk-buffer RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -V -RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -t +#RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -t EXPOSE 514 EXPOSE 601/tcp @@ -98,6 +99,6 @@ EXPOSE 6514/tcp ENV SPLUNK_CONNECT_METHOD=UF -ENTRYPOINT ["/opt/syslog-ng/sbin/syslog-ng", "-F"] +ENTRYPOINT ["/entrypoint.sh", "-F"] HEALTHCHECK --interval=1s --timeout=6s CMD source scl_source enable rh-python36 ;goss -g /etc/goss.yaml validate diff --git a/package/etc/conf.d/conflib/_common/network.conf b/package/etc/conf.d/conflib/_common/network.conf deleted file mode 100644 index ae13635..0000000 --- a/package/etc/conf.d/conflib/_common/network.conf +++ /dev/null @@ -1,10 +0,0 @@ -@module confgen context(source) name(gen_source_dedicated_port) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/conflib/_common/network.conf.tmpl") - -block source dedicated_port(udp_port(no) tcp_port(no) tls_port(no) flags("no-parse")) { - gen_source_dedicated_port( - udp_port(`udp_port`) - tcp_port(`tcp_port`) - tls_port(`tls_port`) - flags(`flags`) - ) -}; \ No newline at end of file diff --git a/package/etc/conf.d/conflib/_common/network.conf.tmpl b/package/etc/conf.d/conflib/_common/network.conf.tmpl index 9b6c3a1..e69de29 100644 --- a/package/etc/conf.d/conflib/_common/network.conf.tmpl +++ b/package/etc/conf.d/conflib/_common/network.conf.tmpl @@ -1,93 +0,0 @@ -# =============================================================================================== -# source definition for remote devices -# =============================================================================================== - -# =============================================================================================== -# Defaults for the default-network-drivers() source: -# 514, both TCP and UDP, for RFC3164 (BSD-syslog) formatted traffic -# 601 TCP, for RFC5424 (IETF-syslog) formatted traffic -# 6514 TCP, for TLS-encrypted traffic -# =============================================================================================== - - channel { - source { -{{ if ne (getenv "confgen_udp_port") "no" }} - syslog ( - transport("udp") - port({{getenv "confgen_udp_port"}}) - ip-protocol(4) - so-rcvbuf({{getenv "SC4S_SOURCE_UDP_SO_RCVBUFF" "425984"}}) - keep-hostname(yes) - keep-timestamp(yes) - use-dns(no) - use-fqdn(no) - chain-hostnames(off) - flags(no-parse) - ); -{{ end }} -{{ if ne (getenv "confgen_tcp_port") "no" }} - network ( - transport("tcp") - port({{getenv "confgen_tcp_port"}}) - ip-protocol(4) - max-connections({{getenv "SC4S_SOURCE_TCP_MAX_CONNECTIONS" "2000"}}) - log-iw-size({{getenv "SC4S_SOURCE_TCP_IW_SIZE" "20000000"}}) - log-fetch-limit({{getenv "SC4S_SOURCE_TCP_FETCH_LIMIT" "2000"}}) - keep-hostname(yes) - keep-timestamp(yes) - use-dns(no) - use-fqdn(no) - chain-hostnames(off) - flags(no-parse) - ); -{{ end }} - }; - #TODO: #60 Remove this function with enhancement - rewrite(set_rfcnonconformant); - -{{ if eq (getenv "confgen_parser") "rfc5424_strict" }} - filter(f_rfc5424_strict); - parser { - syslog-parser(flags(syslog-protocol store-raw-message)); - }; - rewrite(set_rfc5424_strict); -{{ else if eq (getenv "confgen_parser") "rfc5424_noversion" }} - filter(f_rfc5424_noversion); - parser { - syslog-parser(flags(syslog-protocol store-raw-message)); - }; - rewrite(set_rfc5424_noversion); -{{ else if eq (getenv "confgen_parser") "cisco_parser" }} - parser {cisco-parser()}; - rewrite(set_metadata_vendor_product_cisco_ios); -{{ else if eq (getenv "confgen_parser") "rfc3164" }} - parser { - syslog-parser(time-zone({{getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}}) flags(store-raw-message)); - }; - rewrite(set_rfc3164); -{{ else }} - if { - filter(f_rfc5424_strict); - parser { - syslog-parser(flags(syslog-protocol store-raw-message)); - }; - rewrite(set_rfc5424_strict); - } elif { - filter(f_rfc5424_noversion); - parser { - syslog-parser(flags(syslog-protocol store-raw-message)); - }; - rewrite(set_rfc5424_noversion); - } elif { - parser {cisco-parser()}; - rewrite(set_metadata_vendor_product_cisco_ios); - } else { - parser { - syslog-parser(time-zone({{getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}}) flags(store-raw-message)); - }; - rewrite(set_rfc3164); - }; -{{ end }} - rewrite(r_set_splunk_default); - - }; diff --git a/package/etc/conf.d/destinations/splunk_hec.conf b/package/etc/conf.d/destinations/splunk_hec.conf deleted file mode 100644 index 81db7ee..0000000 --- a/package/etc/conf.d/destinations/splunk_hec.conf +++ /dev/null @@ -1,5 +0,0 @@ -@module confgen context(destination) name(gen_splunk_hec) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/destinations/splunk_hec.conf.tmpl") - -destination d_hec { - gen_splunk_hec() -}; diff --git a/package/etc/conf.d/destinations/splunk_hec.conf.tmpl b/package/etc/conf.d/destinations/splunk_hec.conf.tmpl index 1f374b9..3263f66 100644 --- a/package/etc/conf.d/destinations/splunk_hec.conf.tmpl +++ b/package/etc/conf.d/destinations/splunk_hec.conf.tmpl @@ -1,38 +1,42 @@ +destination d_hec { http( - url("{{getenv "SPLUNK_HEC_URL"}}") + url("{{- getenv "SPLUNK_HEC_URL"}}") method("POST") - log-fifo-size({{getenv "SC4S_DEST_SPLUNK_HEC_LOG_FIFO_SIZE" "180000000"}}) - workers({{getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10"}}) - batch-lines({{getenv "SC4S_DEST_SPLUNK_HEC_BATCH_LINES" "1000"}}) - batch-bytes({{getenv "SC4S_DEST_SPLUNK_HEC_BATCH_BYTES" "4096kb"}}) - batch-timeout({{getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "1"}}) - timeout({{getenv "SC4S_DEST_SPLUNK_HEC_TIMEOUT" "30"}}) + log-fifo-size({{- getenv "SC4S_DEST_SPLUNK_HEC_LOG_FIFO_SIZE" "180000000"}}) + workers({{- getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10"}}) + batch-lines({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_LINES" "1000"}}) + batch-bytes({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_BYTES" "4096kb"}}) + batch-timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "1"}}) + timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_TIMEOUT" "30"}}) user_agent("sc4s/1.0 (events)") user("sc4s") - headers("{{getenv "SC4S_DEST_SPLUNK_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") - password("{{getenv "SPLUNK_HEC_TOKEN"}}") + headers("{{- getenv "SC4S_DEST_SPLUNK_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") + password("{{- getenv "SPLUNK_HEC_TOKEN"}}") - {{ if eq (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_ENABLE" "yes") "yes" }} + {{- if eq (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_ENABLE" "yes") "yes"}} persist-name("splunk_hec") disk-buffer( - {{ if eq (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_RELIABLE" "no") "yes" }} - mem-buf-size({{getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFSIZE" "10241024"}}) + {{- if eq (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_RELIABLE" "no") "yes"}} + mem-buf-size({{- getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFSIZE" "10241024"}}) reliable(yes) - {{else}} - mem-buf-length({{getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFLENGTH" "15000"}}) + {{- else}} + mem-buf-length({{- getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFLENGTH" "15000"}}) reliable(no) - {{ end }} + {{- end}} - disk-buf-size({{getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DISKBUFSIZE" "1048576"}}) + disk-buf-size({{- getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DISKBUFSIZE" "1048576"}}) dir("/opt/syslog-ng/var/data/disk-buffer/") ) - {{ end }} - tls(peer-verify({{getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) -{{if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} cipher-suite("{{getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}"){{end}} -{{if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} ssl-version("{{getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}"){{end}} - ca-file("{{getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}") - ) + {{- end}} + tls(peer-verify({{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} + cipher-suite("{{- getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}") + {{- end}} + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} + ssl-version("{{- getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}") + {{- end}} + ca-file("{{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}")) body('$(format-json time=$S_UNIXTIME.$S_MSEC host=${HOST} @@ -42,3 +46,4 @@ event=$(template ${fields.sc4s_template} $(template "t_standard")) fields.*)') ); +}; \ No newline at end of file diff --git a/package/etc/conf.d/destinations/splunk_hec_internal.conf b/package/etc/conf.d/destinations/splunk_hec_internal.conf deleted file mode 100644 index fee875e..0000000 --- a/package/etc/conf.d/destinations/splunk_hec_internal.conf +++ /dev/null @@ -1,5 +0,0 @@ -@module confgen context(destination) name(gen_splunk_hec_internal) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/destinations/splunk_hec_internal.conf.tmpl") - -destination d_hec_internal { - gen_splunk_hec_internal() -}; diff --git a/package/etc/conf.d/destinations/splunk_hec_internal.conf.tmpl b/package/etc/conf.d/destinations/splunk_hec_internal.conf.tmpl index 32f4969..7f7c330 100644 --- a/package/etc/conf.d/destinations/splunk_hec_internal.conf.tmpl +++ b/package/etc/conf.d/destinations/splunk_hec_internal.conf.tmpl @@ -1,23 +1,27 @@ +destination d_hec_internal { http( - url("{{getenv "SPLUNK_HEC_URL"}}") + url("{{- getenv "SPLUNK_HEC_URL"}}") method("POST") - log-fifo-size({{getenv "SC4S_DEST_SPLUNK_HEC_LOG_FIFO_SIZE" "180000000"}}) + log-fifo-size({{- getenv "SC4S_DEST_SPLUNK_HEC_LOG_FIFO_SIZE" "180000000"}}) workers(1) - batch-lines({{getenv "SC4S_DEST_SPLUNK_HEC_BATCH_LINES" "1000"}}) - batch-bytes({{getenv "SC4S_DEST_SPLUNK_HEC_BATCH_BYTES" "4096kb"}}) - batch-timeout({{getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "1"}}) - timeout({{getenv "SC4S_DEST_SPLUNK_HEC_TIMEOUT" "30"}}) + batch-lines({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_LINES" "1000"}}) + batch-bytes({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_BYTES" "4096kb"}}) + batch-timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "1"}}) + timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_TIMEOUT" "30"}}) user_agent("sc4s/1.0 (events)") user("sc4s") - headers("{{getenv "SC4S_DEST_SPLUNK_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") - password("{{getenv "SPLUNK_HEC_TOKEN"}}") + headers("{{- getenv "SC4S_DEST_SPLUNK_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") + password("{{- getenv "SPLUNK_HEC_TOKEN"}}") - tls(peer-verify({{getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) -{{if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} cipher-suite("{{getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}"){{end}} -{{if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} ssl-version("{{getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}"){{end}} - ca-file("{{getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}") - ) + tls(peer-verify({{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} + cipher-suite("{{- getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}") + {{- end}} + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} + ssl-version("{{- getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}") + {{- end}} + ca-file("{{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}")) body('$(format-json time=$S_UNIXTIME.$S_MSEC host=${HOST} @@ -27,3 +31,4 @@ event=$(template ${fields.sc4s_template} $(template "t_standard")) fields.*)') ); +}; \ No newline at end of file diff --git a/package/etc/conf.d/destinations/splunk_hec_metrics.conf b/package/etc/conf.d/destinations/splunk_hec_metrics.conf deleted file mode 100644 index 1183f94..0000000 --- a/package/etc/conf.d/destinations/splunk_hec_metrics.conf +++ /dev/null @@ -1,6 +0,0 @@ -@module confgen context(destination) name(gen_splunk_hec_metrics) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/destinations/splunk_hec_metrics.conf.tmpl") - - -destination d_hecmetrics { - gen_splunk_hec_metrics() -}; diff --git a/package/etc/conf.d/destinations/splunk_hec_metrics.conf.tmpl b/package/etc/conf.d/destinations/splunk_hec_metrics.conf.tmpl index 7b8d9a1..35484f9 100644 --- a/package/etc/conf.d/destinations/splunk_hec_metrics.conf.tmpl +++ b/package/etc/conf.d/destinations/splunk_hec_metrics.conf.tmpl @@ -1,5 +1,6 @@ +destination d_hecmetrics { http( - url("{{getenv "SPLUNK_HEC_URL"}}") + url("{{- getenv "SPLUNK_HEC_URL"}}") method("POST") batch-lines(50) batch-bytes(1024Kb) @@ -7,14 +8,18 @@ timeout(15) user_agent("sc4s/1.0 (internal metrics)") user("sc4s") - headers("{{getenv "SC4S_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") - password("{{getenv "SPLUNK_HEC_TOKEN"}}") + headers("{{- getenv "SC4S_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") + password("{{- getenv "SPLUNK_HEC_TOKEN"}}") persist-name("splunk_metrics") - tls(peer-verify({{getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) -{{if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} cipher-suite("{{getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}"){{end}} -{{if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} ssl-version("{{getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}"){{end}} - ca-file("{{getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}") - ) + tls(peer-verify({{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} + cipher-suite("{{- getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}") + {{- end}} + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} + ssl-version("{{- getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}") + {{- end}} + ca-file("{{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}")) body('$MESSAGE') ); +}; \ No newline at end of file diff --git a/package/etc/conf.d/destinations/stdout.conf b/package/etc/conf.d/destinations/stdout.conf deleted file mode 100644 index ee9e933..0000000 --- a/package/etc/conf.d/destinations/stdout.conf +++ /dev/null @@ -1,6 +0,0 @@ -@module confgen context(destination) name(gen_std_out) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/destinations/stdout.conf.tmpl") - - -destination d_stdout { - gen_std_out() -}; diff --git a/package/etc/conf.d/destinations/stdout.conf.tmpl b/package/etc/conf.d/destinations/stdout.conf.tmpl index 2540674..19bf66a 100644 --- a/package/etc/conf.d/destinations/stdout.conf.tmpl +++ b/package/etc/conf.d/destinations/stdout.conf.tmpl @@ -1 +1,3 @@ - file("/dev/stdout"); \ No newline at end of file +destination d_stdout { + file("/dev/stdout"); +}; \ No newline at end of file diff --git a/package/etc/conf.d/conflib/vendor_cisco/asa.conf b/package/etc/conf.d/filters/cisco/asa.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_cisco/asa.conf rename to package/etc/conf.d/filters/cisco/asa.conf diff --git a/package/etc/conf.d/conflib/vendor_cisco/ios.conf b/package/etc/conf.d/filters/cisco/ios.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_cisco/ios.conf rename to package/etc/conf.d/filters/cisco/ios.conf diff --git a/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf b/package/etc/conf.d/filters/cisco/nx-os.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_cisco/nx-os.conf rename to package/etc/conf.d/filters/cisco/nx-os.conf diff --git a/package/etc/conf.d/conflib/vendor_fortinet/fortios.conf b/package/etc/conf.d/filters/fortinet/fortios.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_fortinet/fortios.conf rename to package/etc/conf.d/filters/fortinet/fortios.conf diff --git a/package/etc/conf.d/conflib/vendor_juniper/junos.conf b/package/etc/conf.d/filters/juniper/junos.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_juniper/junos.conf rename to package/etc/conf.d/filters/juniper/junos.conf diff --git a/package/etc/conf.d/conflib/vendor_juniper/legacy.conf b/package/etc/conf.d/filters/juniper/legacy.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_juniper/legacy.conf rename to package/etc/conf.d/filters/juniper/legacy.conf diff --git a/package/etc/conf.d/conflib/vendor_pan/panos.conf b/package/etc/conf.d/filters/paloalto/panos.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_pan/panos.conf rename to package/etc/conf.d/filters/paloalto/panos.conf diff --git a/package/etc/conf.d/conflib/vendor_symantec/bluecoat_proxy.conf b/package/etc/conf.d/filters/symantec/bluecoat_proxy.conf similarity index 100% rename from package/etc/conf.d/conflib/vendor_symantec/bluecoat_proxy.conf rename to package/etc/conf.d/filters/symantec/bluecoat_proxy.conf diff --git a/package/etc/conf.d/log_paths/internal.conf b/package/etc/conf.d/log_paths/internal.conf deleted file mode 100644 index 2582fd4..0000000 --- a/package/etc/conf.d/log_paths/internal.conf +++ /dev/null @@ -1,9 +0,0 @@ -@module confgen context(log) name(gen_log_internal) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/internal.conf.tmpl") - -log { - #Default source - gen_log_internal( - - ); - -}; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/internal.conf.tmpl b/package/etc/conf.d/log_paths/internal.conf.tmpl index 6d1d7aa..7ed823e 100644 --- a/package/etc/conf.d/log_paths/internal.conf.tmpl +++ b/package/etc/conf.d/log_paths/internal.conf.tmpl @@ -1,3 +1,5 @@ +{{- define "log_path"}} +log { source(s_internal); if (match("^Log statistics; " value("MESSAGE"))) { @@ -30,11 +32,14 @@ destination(d_hecmetrics); #--HEC-- } else { - parser {p_add_context_splunk(key("sc4s_events")); }; - {{ if eq (getenv "SC4S_DEBUG_STDOUT" "yes") "yes" }} + {{- if eq (getenv "SC4S_DEBUG_STDOUT" "yes") "yes"}} destination(d_stdout); - {{ end }} + {{- end}} rewrite { r_set_splunk_dest_default(sourcetype("sc4s:events"), index("main"), template("t_msg_only"))}; + parser {p_add_context_splunk(key("sc4s_events")); }; destination(d_hec_internal); - }; \ No newline at end of file + }; + }; +{{- end}} +{{- tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf deleted file mode 100644 index ab1dda1..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf +++ /dev/null @@ -1,21 +0,0 @@ -# =============================================================================================== -# Cisco ASA (Firewall) -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_3164-cisco-asa) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-cisco_asa.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-cisco-asa( - sourcedefault(yes) - ); - -}; - -log { - #Default source - gen_log_rfc_3164-cisco-asa( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf.tmpl index a8e9b29..eed0507 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf.tmpl @@ -1,22 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Cisco ASA +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_LEGACY_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_LEGACY_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_LEGACY_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "CISCO_ASA_LEGACY" "parser" "common"}} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc3164); filter(f_cisco_asa); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_CISCO_ASA_LEGACY_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_CISCO_ASA_LEGACY_UDP_PORT" }}) - ) - }; -{{ end }} - - #set the source type based on program field and lookup index from the splunk context csv - #Using the 5424 parser the message content is all we need +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_CISCO_ASA_LEGACY); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"), template("t_msg_only"))}; parser {p_add_context_splunk(key("cisco_asa")); }; @@ -24,3 +20,14 @@ destination(d_hec); #--HEC-- flags(flow-control); + +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_LEGACY_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_LEGACY_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_LEGACY_TLS_PORT") "no") "no") }} + +# Listen on the specified dedicated port(s) for CISCO_ASA_LEGACY traffic + {{tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for CISCO_ASA_LEGACY traffic +{{tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf deleted file mode 100644 index 44bd40f..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf +++ /dev/null @@ -1,22 +0,0 @@ - -# =============================================================================================== -# Cisco IOS (Route/Switch) -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_3164-cisco-ios) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-cisco_ios.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-cisco-ios( - sourcedefault(yes) - ); - -}; - -log { - #Default source - gen_log_rfc_3164-cisco-ios( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf.tmpl index 67fc196..6518a0d 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf.tmpl @@ -1,19 +1,17 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Cisco IOS +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_IOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_IOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_IOS_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "CISCO_IOS" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes" }} source(s_default-ports); filter(f_cisco_ios); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_CISCO_IOS_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_CISCO_IOS_UDP_PORT" }}) - - ) - }; -{{ end }} +{{- end }} +{{- if eq (.) "no" }} + source (s_dedicated_port_CISCO_IOS); +{{- end }} rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"), template("t_msg_only"))}; parser { @@ -23,3 +21,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_IOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_IOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_IOS_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for CISCO_IOS traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for CISCO_IOS traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf deleted file mode 100644 index 5e98035..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf +++ /dev/null @@ -1,22 +0,0 @@ - -# =============================================================================================== -# Cisco IOS (Route/Switch) -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_3164-cisco-nx-os) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-cisco-nx-os( - sourcedefault(yes) - ); - -}; - -log { - #Default source - gen_log_rfc_3164-cisco-nx-os( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf.tmpl index a6c1e20..2caff20 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_nx-os.conf.tmpl @@ -1,19 +1,17 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Cisco NX_OS +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_NX_OS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_NX_OS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_NX_OS_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "CISCO_NX_OS" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_cisco_nx_os); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_CISCO_NX_OS_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_CISCO_NX_OS_UDP_PORT" }}) - - ) - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_CISCO_NX_OS); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"), template("t_hdr_msg"))}; parser { @@ -23,3 +21,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_NX_OS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_NX_OS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_NX_OS_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for CISCO_NX_OS traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for CISCO_NX_OS traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf deleted file mode 100644 index 5ee38f6..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf +++ /dev/null @@ -1,22 +0,0 @@ - -# =============================================================================================== -# Fortigate FortiOS -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_3164-fortigate-fortios) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-fortigate-fortios( - sourcedefault(yes) - ); - -}; - -log { - #Default source - gen_log_rfc_3164-fortigate-fortios( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf.tmpl index 6684b30..b030c31 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf.tmpl @@ -1,31 +1,26 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Fortinet Fortios +{{- if (ne (getenv (print "SC4S_LISTEN_FORTINET_FORTIOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_FORTINET_FORTIOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_FORTINET_FORTIOS_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "FORTINET_FORTIOS" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc3164); filter(f_fortinet_fortios); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_FORTINET_FORTIOS_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_FORTINET_FORTIOS_UDP_PORT" }}) - - ) - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_FORTINET_FORTIOS); +{{- end}} parser { kv-parser(prefix(".kv.") template("${MSGHDR} ${MSG}")); - date-parser(format("%Y-%m-%d:%H:%M:%S") template("${.kv.date}:${.kv.time}") time-zone({{getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}})); + date-parser(format("%Y-%m-%d:%H:%M:%S") template("${.kv.date}:${.kv.time}") time-zone({{- getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}})); }; rewrite { set("${.kv.devname}", value("HOST")); }; - #set the source type based on program field and lookup index from the splunk context csv - - if (match("traffic" value(".kv.type"))) { rewrite { r_set_splunk_dest_default(sourcetype("fgt_traffic"), index("netfw"), template("t_standard"))}; parser {p_add_context_splunk(key("fortinet_fortios_traffic")); }; @@ -43,3 +38,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_FORTINET_FORTIOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_FORTINET_FORTIOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_FORTINET_FORTIOS_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for FORTINET_FORTIOS traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for FORTINET_FORTIOS traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf deleted file mode 100644 index 0509425..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf +++ /dev/null @@ -1,17 +0,0 @@ -@module confgen context(log) name(gen_log_rfc_3164-juniper-idp) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-juniper_idp.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-juniper-idp( - sourcedefault(yes) - ); - -}; - -log { - #Specific source - gen_log_rfc_3164-juniper-idp( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf.tmpl index 9589805..c469bec 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_idp.conf.tmpl @@ -1,19 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Juniper IDP +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_IDP_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_IDP_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_IDP_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "JUNIPER_IDP" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc5424_strict); filter(f_juniper_idp); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_IDP_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_IDP_UDP_PORT" }}) - ); - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_JUNIPER_IDP); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("juniper:idp"), index("netids"), template("t_hdr_sdata_msg"))}; parser { @@ -23,3 +22,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_IDP_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_IDP_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_IDP_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for JUNIPER_IDP traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for JUNIPER_IDP traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf deleted file mode 100644 index 9c9a9b6..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf +++ /dev/null @@ -1,17 +0,0 @@ -@module confgen context(log) name(gen_log_rfc_3164-juniper-junos) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-juniper_junos.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-juniper-junos( - sourcedefault(yes) - ); - -}; - -log { - #Specific source - gen_log_rfc_3164-juniper-junos( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf.tmpl index 3850ad4..abe69d4 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_junos.conf.tmpl @@ -1,20 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Juniper JunOS +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "JUNIPER_JUNOS" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc3164); filter(f_juniper_junos_standard); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_JUNOS_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_JUNOS_UDP_PORT" }}) - - ) - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_JUNIPER_JUNOS); +{{- end}} if (program('RT_IDP')) { rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp"), index("netids"), template("t_standard"))}; @@ -39,3 +37,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for JUNIPER_JUNOS traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for JUNIPER_JUNOS traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf deleted file mode 100644 index 83de2bd..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf +++ /dev/null @@ -1,17 +0,0 @@ -@module confgen context(log) name(gen_log_rfc_3164-juniper-netscreen) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-juniper-netscreen( - sourcedefault(yes) - ); - -}; - -log { - #Specific source - gen_log_rfc_3164-juniper-netscreen( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf.tmpl index a800328..4b6289b 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf.tmpl @@ -1,18 +1,17 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Juniper Netscreen +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NETSCREEN_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NETSCREEN_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "JUNIPER_NETSCREEN" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_juniper_netscreen); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_NETSCREEN_UDP_PORT" }}) - ) - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_JUNIPER_NETSCREEN); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("netscreen:firewall"), @@ -26,3 +25,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_NETSCREEN_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NETSCREEN_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NETSCREEN_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for JUNIPER_NETSCREEN traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for JUNIPER_NETSCREEN traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf deleted file mode 100644 index b552088..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf +++ /dev/null @@ -1,21 +0,0 @@ -# =============================================================================================== -# Juniper NSM -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_3164-juniper-nsm) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-juniper_nsm.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-juniper-nsm( - sourcedefault(yes) - ); - -}; - -log { - #Specific source - gen_log_rfc_3164-juniper-nsm( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf.tmpl index e637dc4..f33f941 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf.tmpl @@ -1,19 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Juniper NSM +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "JUNIPER_NSM" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc3164); filter(f_juniper_nsm); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_NSM_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_NSM_UDP_PORT" }}) - ) - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_JUNIPER_NSM); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("juniper:nsm"), index("netfw"), template("t_standard"))}; @@ -23,3 +22,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for JUNIPER_NSM traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for JUNIPER_NSM traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf deleted file mode 100644 index ecfa966..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf +++ /dev/null @@ -1,21 +0,0 @@ -# =============================================================================================== -# Juniper NSM IDP -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_3164-juniper-nsm-idp) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-juniper-nsm-idp( - sourcedefault(yes) - ); - -}; - -log { - #Specific source - gen_log_rfc_3164-juniper-nsm-idp( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf.tmpl index 2974ff2..31f8dd6 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm_idp.conf.tmpl @@ -1,19 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Juniper NSM IDP +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_IDP_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_IDP_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_IDP_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "JUNIPER_NSM_IDP" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc3164); filter(f_juniper_nsm_idp); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_NSM_IDP_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_NSM_IDP_UDP_PORT" }}) - ) - }; -{{ end }} +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_JUNIPER_NSM_IDP); +{{- end}} rewrite {r_set_splunk_dest_default(sourcetype("juniper:nsm:idp"), index("netids"), template("t_standard"))}; parser { @@ -22,3 +21,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_IDP_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_IDP_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_NSM_IDP_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for JUNIPER_NSM_IDP traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for JUNIPER_NSM_IDP traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf b/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf deleted file mode 100644 index 7eccabe..0000000 --- a/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf +++ /dev/null @@ -1,17 +0,0 @@ -@module confgen context(log) name(gen_log_rfc_3164-palalto-panos) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl") - -log { - #Default source - gen_log_rfc_3164-palalto-panos( - sourcedefault(yes) - ); - -}; - -log { - #Specific source - gen_log_rfc_3164-palalto-panos( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl index 58e98e9..ca0933f 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl @@ -1,25 +1,24 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# PaloAlto PanOS +{{- if (ne (getenv (print "SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_PALOALTO_PANOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_PALOALTO_PANOS_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "PALOALTO_PANOS" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc3164); filter(f_paloalto_panos); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_PALOALTO_PANOS_UDP_PORT" }}) +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_PALOALTO_PANOS); +{{- end}} - ) - }; -{{ end }} - - # the palo message does not include a program value in the header unfortunatly - # the use of colon in the message tricks the RFC3164 parser we will re-write the message + # The palo message does not include a program value in the header, unfortunately. + # The use of colon in the message tricks the RFC3164 parser; We will re-write the message # so the parser will not incorrectly break it apart. - # while we are at it we will save the mesage type into the program field so parser can find it + # While we are at it we will save the mesage type into the program field so parser can find it. + rewrite { set("${LEGACY_MSGHDR}${MESSAGE}" value("MESSAGE")); unset(value("LEGACY_MSGHDR")); @@ -29,7 +28,7 @@ parser { #basic parsing - #we need to actual even time from the field GeneratedTime use csv parser to get it out + #we need to actual even time from the field GeneratedTime. Use csv-parser to extract it. csv-parser( columns('FUTURE_USE', 'ReceiveTime', 'SerialNumber', 'Type', 'Subtype', 'FUTURE_USE2', 'GeneratedTime') prefix(".pan.") @@ -44,7 +43,8 @@ ); }; - #set the source type based on program field and lookup index from the splunk context csv + #set the source type based on program field and lookup index from the splunk_context csv + if (message(',\d+,THREAT')) { rewrite { r_set_splunk_dest_default(sourcetype("pan:threat"), index("netproxy"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_threat")); }; @@ -74,3 +74,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_PALOALTO_PANOS_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_PALOALTO_PANOS_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_PALOALTO_PANOS_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for PALOALTO_PANOS traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for PALOALTO_PANOS traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf deleted file mode 100644 index eff1858..0000000 --- a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf +++ /dev/null @@ -1,22 +0,0 @@ - -# =============================================================================================== -# Cisco IOS ASA -# =============================================================================================== - -@module confgen context(log) name(gen_log_rfc_5424_noversion-cisco-asa) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf.tmpl") - -log { - #Default source - gen_log_rfc_5424_noversion-cisco-asa( - sourcedefault(yes) - ); - -}; - -log { - #Default source - gen_log_rfc_5424_noversion-cisco-asa( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf.tmpl index 4aeacfe..ffe1cdb 100644 --- a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf.tmpl @@ -1,23 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Cisco ASA RFC5424 +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "CISCO_ASA" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc5424_noversion); filter(f_cisco_asa); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_CISCO_ASA_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_CISCO_ASA_UDP_PORT" }}) - - ) - }; -{{ end }} - - #set the source type based on program field and lookup index from the splunk context csv - #Using the 5424 parser the message content is all we need +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_CISCO_ASA); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"), template("t_msg_only"))}; parser {p_add_context_splunk(key("cisco_asa")); }; @@ -25,3 +20,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_CISCO_ASA_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for CISCO_ASA traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for CISCO_ASA traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf deleted file mode 100644 index cc380fe..0000000 --- a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf +++ /dev/null @@ -1,17 +0,0 @@ - -@module confgen context(log) name(gen_log_rfc_5424_noversion-symantec_proxy) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf.tmpl") - -log { - #Default source - gen_log_rfc_5424_noversion-symantec_proxy( - sourcedefault(yes) - ); - -}; -log { - #Default source - gen_log_rfc_5424_noversion-symantec_proxy( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf.tmpl index b651236..6f3879c 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec_proxy.conf.tmpl @@ -1,23 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Symantec Proxy (Bluecoat) +{{- if (ne (getenv (print "SC4S_LISTEN_SYMANTEC_PROXY_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_SYMANTEC_PROXY_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_SYMANTEC_PROXY_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "SYMANTEC_PROXY" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc5424_noversion); filter(f_symantec_bluecoat_proxy); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_SYMANTEC_PROXY_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_SYMANTEC_PROXY_UDP_PORT" }}) - - ) - }; -{{ end }} - - #set the source type based on program field and lookup index from the splunk context csv. - #With the 5424 parser the message is the only portion needed in the template. +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_SYMANTEC_PROXY); +{{- end}} rewrite { r_set_splunk_dest_default(sourcetype("bluecoat:proxysg:access:kv"), index("netproxy"), template("t_msg_only")) }; @@ -26,3 +21,12 @@ destination(d_hec); #--HEC-- flags(flow-control); +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_SYMANTEC_PROXY_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_SYMANTEC_PROXY_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_SYMANTEC_PROXY_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for SYMANTEC_PROXY traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for SYMANTEC_PROXY traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf deleted file mode 100644 index e126b85..0000000 --- a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf +++ /dev/null @@ -1,21 +0,0 @@ -# =============================================================================================== -# Juniper Structured logging -# =============================================================================================== - - -@module confgen context(log) name(gen_log_rfc_5424_strict-juniper_junos) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf.tmpl") - -log { - #Default source - gen_log_rfc_5424_strict-juniper_junos( - sourcedefault(yes) - ); - -}; -log { - #Default source - gen_log_rfc_5424_strict-juniper_junos( - sourcedefault(no) - ); - -}; diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf.tmpl index bfa3fad..bf1b644 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper_junos.conf.tmpl @@ -1,21 +1,18 @@ -#The template will be used to produce two log paths -#The first log path is linked to the default (shared) 514 -{{ if eq (getenv "confgen_sourcedefault") "yes" }} +# Juniper JunOS (Structured, RFC5424-compliant) +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_STRUCTURED_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_STRUCTURED_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_STRUCTURED_TLS_PORT") "no") "no") }} +{{ $context := dict "port_id" "JUNIPER_JUNOS_STRUCTURED" "parser" "common" }} +{{ tmpl.Exec "t/source_network.t" $context }} +{{- end -}} +{{ define "log_path" }} +log { +{{- if eq (.) "yes"}} source(s_default-ports); filter(f_is_rfc5424_strict); filter(f_juniper_junos_structured); -{{ end }} -#The second log path will only generate if the value of one OR more port variables is set -{{ if eq (getenv "confgen_sourcedefault") "no" }} - source { - dedicated_port( - tcp_port({{ getenv "SC4S_LISTEN_JUNIPER_JUNOS_TCP_PORT" }}) - udp_port({{ getenv "SC4S_LISTEN_JUNIPER_JUNOS_UDP_PORT" }}) - ) - }; -{{ end }} - - +{{- end}} +{{- if eq (.) "no"}} + source (s_dedicated_port_JUNIPER_JUNOS_STRUCTURED); +{{- end}} if (program('RT_IDP')) { rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp:structured"), index("netids"), template("t_JSON_5424")) }; parser {p_add_context_splunk(key("juniper_idp_structured")); }; @@ -41,3 +38,12 @@ }; destination(d_hec); #--HEC-- +}; +{{- end}} +{{- if (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_STRUCTURED_TCP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_STRUCTURED_UDP_PORT") "no") "no") or (ne (getenv (print "SC4S_LISTEN_JUNIPER_JUNOS_STRUCTURED_TLS_PORT") "no") "no") }} +# Listen on the specified dedicated port(s) for JUNIPER_JUNOS_STRUCTURED traffic + {{ tmpl.Exec "log_path" "no" }} +{{- end}} + +# Listen on the default port (typically 514) for JUNIPER_JUNOS_STRUCTURED traffic +{{ tmpl.Exec "log_path" "yes" }} diff --git a/package/etc/conf.d/sources/network.conf b/package/etc/conf.d/sources/network.conf deleted file mode 100644 index 599061d..0000000 --- a/package/etc/conf.d/sources/network.conf +++ /dev/null @@ -1,6 +0,0 @@ -@module confgen context(source) name(gen_s_default_ports) exec("gomplate --file `syslog-ng-sysconfdir`/conf.d/sources/network.conf.tmpl") - -source s_default-ports { - gen_s_default_ports() -}; - diff --git a/package/etc/conf.d/sources/network.conf.tmpl b/package/etc/conf.d/sources/network.conf.tmpl index d40b914..9a20741 100644 --- a/package/etc/conf.d/sources/network.conf.tmpl +++ b/package/etc/conf.d/sources/network.conf.tmpl @@ -8,6 +8,7 @@ # 601 TCP, for RFC5424 (IETF-syslog) formatted traffic # 6514 TCP, for TLS-encrypted traffic # =============================================================================================== +source s_default-ports { channel { source { @@ -15,7 +16,7 @@ transport("udp") port(514) ip-protocol(4) - so-rcvbuf({{getenv "SC4S_SOURCE_UDP_SO_RCVBUFF" "425984"}}) + so-rcvbuf({{- getenv "SC4S_SOURCE_UDP_SO_RCVBUFF" "425984"}}) keep-hostname(yes) keep-timestamp(yes) use-dns(no) @@ -28,9 +29,9 @@ transport("tcp") port(514) ip-protocol(4) - max-connections({{getenv "SC4S_SOURCE_TCP_MAX_CONNECTIONS" "2000"}}) - log-iw-size({{getenv "SC4S_SOURCE_TCP_IW_SIZE" "20000000"}}) - log-fetch-limit({{getenv "SC4S_SOURCE_TCP_FETCH_LIMIT" "2000"}}) + max-connections({{- getenv "SC4S_SOURCE_TCP_MAX_CONNECTIONS" "2000"}}) + log-iw-size({{- getenv "SC4S_SOURCE_TCP_IW_SIZE" "20000000"}}) + log-fetch-limit({{- getenv "SC4S_SOURCE_TCP_FETCH_LIMIT" "2000"}}) keep-hostname(yes) keep-timestamp(yes) use-dns(no) @@ -59,7 +60,7 @@ rewrite(set_metadata_vendor_product_cisco_ios); } else { parser { - syslog-parser(time-zone({{getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}}) flags(store-raw-message)); + syslog-parser(time-zone({{- getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}}) flags(store-raw-message)); }; rewrite(set_rfc3164); }; @@ -70,3 +71,4 @@ vendor_product_by_source(); }; }; +}; \ No newline at end of file diff --git a/package/etc/syslog-ng.conf b/package/etc/syslog-ng.conf index ca63a34..f565484 100644 --- a/package/etc/syslog-ng.conf +++ b/package/etc/syslog-ng.conf @@ -57,8 +57,12 @@ options { @include "conf.d/conflib/blocks/*.conf" @include "conf.d/conflib/blocks/*/*.conf" +@include "conf.d/filters/*/*.conf" @include "conf.d/sources/*.conf" @include "conf.d/destinations/*.conf" - @include "conf.d/log_paths/*.conf" -@include "conf.d/plugin/*/log_paths/*.conf" + +@include "conf.d/local/*/filters/*.conf" +@include "conf.d/local/*/sources/*.conf" +@include "conf.d/local/*/destinations/*.conf" +@include "conf.d/local/*/log_paths/*.conf" diff --git a/package/etc/templates/source_network.t b/package/etc/templates/source_network.t new file mode 100644 index 0000000..022c929 --- /dev/null +++ b/package/etc/templates/source_network.t @@ -0,0 +1,86 @@ +# The following is the dedicated source port declaration for {{ (print .port_id) }} +# Two log paths will be created -- one for the dedicated port(s) and one for the default (typically port 514) + +source s_dedicated_port_{{ .port_id}} { + channel { + source { +{{- if ne (getenv (print "SC4S_LISTEN_" .port_id "_UDP_PORT" ) "no") "no" }} + syslog ( + transport("udp") + port({{getenv (print "SC4S_LISTEN_" .port_id "_UDP_PORT") }}) + ip-protocol(4) + so-rcvbuf({{getenv "SC4S_SOURCE_UDP_SO_RCVBUFF" "425984"}}) + keep-hostname(yes) + keep-timestamp(yes) + use-dns(no) + use-fqdn(no) + chain-hostnames(off) + flags(no-parse) + ); +{{- end}} +{{- if ne (getenv (print "SC4S_LISTEN_" .port_id "_TCP_PORT") "no") "no" }} + network ( + transport("tcp") + port({{getenv (print "SC4S_LISTEN_" .port_id "_TCP_PORT") }}) + ip-protocol(4) + max-connections({{getenv "SC4S_SOURCE_TCP_MAX_CONNECTIONS" "2000"}}) + log-iw-size({{getenv "SC4S_SOURCE_TCP_IW_SIZE" "20000000"}}) + log-fetch-limit({{getenv "SC4S_SOURCE_TCP_FETCH_LIMIT" "2000"}}) + keep-hostname(yes) + keep-timestamp(yes) + use-dns(no) + use-fqdn(no) + chain-hostnames(off) + flags(no-parse) + ); +{{- end}} + }; + #TODO: #60 Remove this function with enhancement + rewrite(set_rfcnonconformant); +{{ if eq .parser "rfc5424_strict" }} + filter(f_rfc5424_strict); + parser { + syslog-parser(flags(syslog-protocol store-raw-message)); + }; + rewrite(set_rfc5424_strict); +{{- else if eq .parser "rfc5424_noversion" }} + filter(f_rfc5424_noversion); + parser { + syslog-parser(flags(syslog-protocol store-raw-message)); + }; + rewrite(set_rfc5424_noversion); +{{- else if eq .parser "cisco_parser" }} + parser {cisco-parser()}; + rewrite(set_metadata_vendor_product_cisco_ios); +{{- else if eq .parser "rfc3164" }} + parser { + syslog-parser(time-zone({{getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}}) flags(store-raw-message)); + }; + rewrite(set_rfc3164); +{{- else }} + if {filter(f_rfc5424_strict); + parser { + syslog-parser(flags(syslog-protocol store-raw-message)); + }; + rewrite(set_rfc5424_strict); + } elif { + filter(f_rfc5424_noversion); + parser { + syslog-parser(flags(syslog-protocol store-raw-message)); + }; + rewrite(set_rfc5424_noversion); + } elif { + parser {cisco-parser()}; + rewrite(set_metadata_vendor_product_cisco_ios); + } else { + parser { + syslog-parser(time-zone({{getenv "SC4S_DEFAULT_TIMEZONE" "GMT"}}) flags(store-raw-message)); + }; + rewrite(set_rfc3164); + }; +{{- end }} + rewrite(r_set_splunk_default); + + }; + +}; \ No newline at end of file diff --git a/package/sbin/entrypoint.sh b/package/sbin/entrypoint.sh new file mode 100755 index 0000000..fe238e8 --- /dev/null +++ b/package/sbin/entrypoint.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +source scl_source enable rh-python36 + +cd /opt/syslog-ng +for d in $(find /opt/syslog-ng/etc -type d) +do + echo Templating conf for $d + gomplate \ + --input-dir=$d \ + --template t=etc/templates/ \ + --exclude=*.conf --exclude=*.csv --exclude=*.t --exclude=.*\ + --output-map="$d/{{ .in | strings.ReplaceAll \".conf.tmpl\" \".conf\" }}" +done + +exec /opt/syslog-ng/sbin/syslog-ng $@ \ No newline at end of file diff --git a/package/syslog-ng b/package/syslog-ng index 08b33b7..1742b11 160000 --- a/package/syslog-ng +++ b/package/syslog-ng @@ -1 +1 @@ -Subproject commit 08b33b7860734526d65f0e827f092dc5ca3c7ff8 +Subproject commit 1742b11e5cfa6544ece38aaecde96e9b423d61c5 diff --git a/tests/test_cisco_asa.py b/tests/test_cisco_asa.py index 7203f32..1399ac8 100644 --- a/tests/test_cisco_asa.py +++ b/tests/test_cisco_asa.py @@ -16,7 +16,7 @@ # Apr 15 2017 00:21:14 192.168.12.1 : %ASA-5-111010: User 'john', running 'CLI' from IP 0.0.0.0, executed 'dir disk0:/dap.xml' # Apr 15 2017 00:22:27 192.168.12.1 : %ASA-4-313005: No matching connection for ICMP error message: icmp src outside:81.24.28.226 dst inside:72.142.17.10 (type 3, code 0) on outside interface. Original IP payload: udp src 72.142.17.10/40998 dst 194.153.237.66/53. # Apr 15 2017 00:22:42 192.168.12.1 : %ASA-3-710003: TCP access denied by ACL from 179.236.133.160/8949 to outside:72.142.18.38/23 -def test_cisco_asa_tradditional(record_property, setup_wordlist, setup_splunk): +def test_cisco_asa_traditional(record_property, setup_wordlist, setup_splunk): host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist)) mt = env.from_string( diff --git a/tests/test_juniper_legacy.py b/tests/test_juniper_legacy.py index 34de672..cd9cbcc 100644 --- a/tests/test_juniper_legacy.py +++ b/tests/test_juniper_legacy.py @@ -108,7 +108,7 @@ def test_juniper_netscreen_fw_singleport(record_property, setup_wordlist, get_ho host = get_host_key mt = env.from_string( - "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1\n") + "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 singleport=5000\n") message = mt.render(mark="<23>", host=host) sendsingle(message, port=5000) From 2caca6d49a2312bffd80050ba9036cdea93b600c Mon Sep 17 00:00:00 2001 From: Ryan Faircloth <35384120+rfaircloth-splunk@users.noreply.github.com> Date: Wed, 25 Sep 2019 06:39:58 -0400 Subject: [PATCH 4/4] fix first step (#93) Fixes #92 --- docs/gettingstarted/docker-systemd-general.md | 6 ++++-- docs/gettingstarted/podman-systemd-general.md | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/gettingstarted/docker-systemd-general.md b/docs/gettingstarted/docker-systemd-general.md index 73c3046..5eed75d 100644 --- a/docs/gettingstarted/docker-systemd-general.md +++ b/docs/gettingstarted/docker-systemd-general.md @@ -5,9 +5,11 @@ Refer to [Getting Started](https://docs.docker.com/get-started/) # Setup -* Create a systemd unit file use to start the container with the host os. ``/lib/systemd/system/sc4s.service`` +* Create a systemd unit file use to start the container with the host os. -*NOTE*: Replace the URL and HEC tokens with the appropriate values for our environment +``sudo vi /lib/systemd/system/sc4s.service`` + +Enter insert mode and paste the following ```ini [Unit] diff --git a/docs/gettingstarted/podman-systemd-general.md b/docs/gettingstarted/podman-systemd-general.md index 65f3125..edfe47c 100644 --- a/docs/gettingstarted/podman-systemd-general.md +++ b/docs/gettingstarted/podman-systemd-general.md @@ -5,9 +5,11 @@ Refer to [Installation](https://podman.io/getting-started/installation) # Setup -* Create a systemd unit file use to start the container with the host os. ``/lib/systemd/system/sc4s.service`` +* Create a systemd unit file use to start the container with the host os. -*NOTE*: Replace the URL and HEC tokens with the appropriate values for our environment +``sudo vi /lib/systemd/system/sc4s.service`` + +Enter insert mode and paste the following ```ini [Unit]