Skip to content

Commit 6564cda

Browse files
huksleyhuksley
committed
Version 4.0.8 compatible with Graylog 4.x
1 parent 83a9a8a commit 6564cda

13 files changed

+734
-730
lines changed

‎pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
<groupId>com.wizecore.graylog2</groupId>
1212
<artifactId>graylog-output-syslog</artifactId>
13-
<version>3.3.2</version>
13+
<version>4.0.8</version>
1414
<packaging>jar</packaging>
1515

1616
<name>graylog-output-syslog</name>
@@ -23,7 +23,7 @@
2323
<maven.install.skip>true</maven.install.skip>
2424
<maven.deploy.skip>true</maven.deploy.skip>
2525
<maven.site.skip>true</maven.site.skip>
26-
<graylog2.version>3.3.0</graylog2.version>
26+
<graylog2.version>4.0.8</graylog2.version>
2727
<graylog2.syslog4j.version>0.9.60</graylog2.syslog4j.version>
2828
<graylog2.plugin-dir>/usr/share/graylog-server/plugin</graylog2.plugin-dir>
2929
</properties>

‎run-graylog

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,27 @@
11
#!/bin/bash
22
HERE=$PWD
3-
GL=~/Downloads/graylog-3.3.1
3+
GL=~/Downloads/graylog-4.0.8
44
TT=$GL/tmp
55
mkdir -p $TT
6-
#sudo umount $TT
7-
#sudo mount -o bind,noexec $TT $TT
8-
#export JAVA_OPTS="-Djava.io.tmpdir=$TT"
9-
#rm -Rf $GL/data
6+
sudo umount $TT
7+
sudo mount -o bind,noexec $TT $TT
8+
export JAVA_OPTS="-Djava.io.tmpdir=$TT"
9+
rm -Rf $GL/data
1010
mkdir -p $GL/data
1111
mvn package -DskipTests
12-
cp target/graylog-output-syslog-3.3.1.jar $GL/plugin
12+
cp target/graylog-output-syslog-4.0.8.jar $GL/plugin
1313
export GRAYLOG_CONF=$GL/graylog.conf
14-
#docker rm -f elastic
15-
#docker run --name elastic -p 9200:9200 -d elasticsearch:5
16-
#docker rm -f mongo
17-
#docker run --name mongo -p 27017:27017 -d mongo:3.6
18-
#docker start elastic
19-
#docker start mongo
20-
sleep 5
14+
sudo sysctl -w vm.max_map_count=262144
15+
16+
docker rm -f elastic
17+
docker run --name elastic -p 9200:9200 -e "discovery.type=single-node" \
18+
-e "cluster.routing.allocation.disk.threshold_enabled=false" \
19+
-d elasticsearch:7.10.1
20+
docker rm -f mongo
21+
docker run --name mongo -p 27017:27017 -d mongo:3.6
22+
docker start elastic
23+
docker start mongo
24+
sleep 10
2125
$GL/bin/graylogctl run
2226

2327
## Run two consoles additionally:

‎src/main/java/com/wizecore/graylog2/plugin/CEFSender.java

Lines changed: 139 additions & 139 deletions
Original file line numberDiff line numberDiff line change
@@ -1,147 +1,147 @@
1-
package com.wizecore.graylog2.plugin;
2-
3-
import java.util.Map;
4-
5-
import org.graylog2.plugin.Message;
6-
import org.graylog2.syslog4j.SyslogConstants;
7-
import org.graylog2.syslog4j.SyslogIF;
8-
9-
/**
10-
* Using CEF format
11-
*/
12-
13-
/*
14-
* http://blog.rootshell.be/2011/05/11/ossec-speaks-arcsight/
15-
*
16-
*
17-
* CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
18-
19-
CEF:0|ArcSight|Logger|5.0.0.5355.2|sensor:115|Logger Internal Event|1|\
20-
cat=/Monitor/Sensor/Fan5 cs2=Current Value cnt=1 dvc=10.0.0.1 cs3=Ok \
21-
cs1=null type=0 cs1Label=unit rt=1305034099211 cs3Label=Status cn1Label=value \
22-
cs2Label=timeframe
23-
*/
24-
public class CEFSender implements MessageSender {
25-
26-
@Override
27-
public void send(SyslogIF syslog, int level, Message msg) {
28-
StringBuilder out = new StringBuilder();
29-
30-
// Header:
31-
// CEF:Version|Device Vendor|Device Product|Device Version|
32-
out.append("CEF:0|Graylog|graylog-output-syslog:cefsender|2.3.1|");
33-
34-
// Device Event Class ID
35-
out.append("log:1");
36-
out.append("|");
37-
38-
Map<String, Object> fields = msg.getFields();
39-
Object fv = fields.get("act");
40-
41-
// Name
42-
String str = fv != null ? fv.toString() : null;
43-
if (str == null) {
44-
fv = fields.get("short_message");
45-
str = fv != null ? fv.toString() : null;
46-
}
47-
if (str == null) {
48-
str = msg.getId();
49-
}
50-
str = escape(str, false);
51-
out.append(str);
52-
53-
// Severity
54-
// The valid integer values are 0-3=Low, 4-6=Medium, 7-8=High, and 9-10=Very-High.
55-
int cefLevel = 0;
56-
/** see {@link org.graylog2.syslog4j.SyslogConstants#LEVEL_INFO} */
57-
switch (level) {
58-
case (SyslogConstants.LEVEL_DEBUG):
59-
cefLevel = 1;
60-
break;
61-
case (SyslogConstants.LEVEL_NOTICE):
62-
cefLevel = 2;
63-
break;
64-
case (SyslogConstants.LEVEL_INFO):
65-
cefLevel = 3;
66-
break;
67-
case (SyslogConstants.LEVEL_WARN):
68-
cefLevel = 6;
69-
break;
70-
case (SyslogConstants.LEVEL_ERROR):
71-
cefLevel = 7;
72-
break;
73-
case (SyslogConstants.LEVEL_CRITICAL):
74-
cefLevel = 8;
75-
break;
76-
case (SyslogConstants.LEVEL_ALERT):
77-
cefLevel = 9;
78-
break;
79-
case (SyslogConstants.LEVEL_EMERGENCY):
80-
cefLevel = 10;
81-
break;
82-
default:
83-
// FIXME: Unknown level
84-
cefLevel = 10;
85-
break;
86-
}
87-
out.append("|").append(cefLevel) .append("|");
88-
89-
// Extension
90-
boolean have = false;
91-
boolean haveExternalId = false;
92-
boolean haveMsg = false;
1+
package com.wizecore.graylog2.plugin;
2+
3+
import java.util.Map;
4+
5+
import org.graylog2.plugin.Message;
6+
import org.graylog2.syslog4j.SyslogConstants;
7+
import org.graylog2.syslog4j.SyslogIF;
8+
9+
/**
10+
* Using CEF format
11+
*/
12+
13+
/*
14+
* http://blog.rootshell.be/2011/05/11/ossec-speaks-arcsight/
15+
*
16+
*
17+
* CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension
18+
19+
CEF:0|ArcSight|Logger|5.0.0.5355.2|sensor:115|Logger Internal Event|1|\
20+
cat=/Monitor/Sensor/Fan5 cs2=Current Value cnt=1 dvc=10.0.0.1 cs3=Ok \
21+
cs1=null type=0 cs1Label=unit rt=1305034099211 cs3Label=Status cn1Label=value \
22+
cs2Label=timeframe
23+
*/
24+
public class CEFSender implements MessageSender {
25+
26+
@Override
27+
public void send(SyslogIF syslog, int level, Message msg) {
28+
StringBuilder out = new StringBuilder();
29+
30+
// Header:
31+
// CEF:Version|Device Vendor|Device Product|Device Version|
32+
out.append("CEF:0|Graylog|graylog-output-syslog:cefsender|2.3.1|");
33+
34+
// Device Event Class ID
35+
out.append("log:1");
36+
out.append("|");
37+
38+
Map<String, Object> fields = msg.getFields();
39+
Object fv = fields.get("act");
40+
41+
// Name
42+
String str = fv != null ? fv.toString() : null;
43+
if (str == null) {
44+
fv = fields.get("short_message");
45+
str = fv != null ? fv.toString() : null;
46+
}
47+
if (str == null) {
48+
str = msg.getId();
49+
}
50+
str = escape(str, false);
51+
out.append(str);
52+
53+
// Severity
54+
// The valid integer values are 0-3=Low, 4-6=Medium, 7-8=High, and 9-10=Very-High.
55+
int cefLevel = 0;
56+
/** see {@link org.graylog2.syslog4j.SyslogConstants#LEVEL_INFO} */
57+
switch (level) {
58+
case (SyslogConstants.LEVEL_DEBUG):
59+
cefLevel = 1;
60+
break;
61+
case (SyslogConstants.LEVEL_NOTICE):
62+
cefLevel = 2;
63+
break;
64+
case (SyslogConstants.LEVEL_INFO):
65+
cefLevel = 3;
66+
break;
67+
case (SyslogConstants.LEVEL_WARN):
68+
cefLevel = 6;
69+
break;
70+
case (SyslogConstants.LEVEL_ERROR):
71+
cefLevel = 7;
72+
break;
73+
case (SyslogConstants.LEVEL_CRITICAL):
74+
cefLevel = 8;
75+
break;
76+
case (SyslogConstants.LEVEL_ALERT):
77+
cefLevel = 9;
78+
break;
79+
case (SyslogConstants.LEVEL_EMERGENCY):
80+
cefLevel = 10;
81+
break;
82+
default:
83+
// FIXME: Unknown level
84+
cefLevel = 10;
85+
break;
86+
}
87+
out.append("|").append(cefLevel) .append("|");
88+
89+
// Extension
90+
boolean have = false;
91+
boolean haveExternalId = false;
92+
boolean haveMsg = false;
9393
boolean haveStart = false;
94-
for (String k: fields.keySet()) {
95-
Object v = fields.get(k);
96-
if (!k.equals("message") && !k.equals("full_message") && !k.equals("short_message")) {
94+
for (String k: fields.keySet()) {
95+
Object v = fields.get(k);
96+
if (!k.equals("message") && !k.equals("full_message") && !k.equals("short_message")) {
9797
String s = v != null ? v.toString() : "null";
98-
s = escape(s, true);
99-
if (have) {
100-
out.append(" ");
98+
s = escape(s, true);
99+
if (have) {
100+
out.append(" ");
101+
}
102+
out.append(k).append('=').append(s);
103+
have = true;
104+
105+
if (!haveExternalId && k.equals("externalId")) {
106+
haveExternalId = true;
107+
}
108+
109+
if (!haveMsg && k.equals("msg")) {
110+
haveMsg = true;
101111
}
102-
out.append(k).append('=').append(s);
103-
have = true;
104-
105-
if (!haveExternalId && k.equals("externalId")) {
106-
haveExternalId = true;
107-
}
108-
109-
if (!haveMsg && k.equals("msg")) {
110-
haveMsg = true;
111-
}
112-
113-
if (!haveStart && k.equals("start")) {
114-
haveStart = true;
115-
}
116-
}
117-
}
118-
119-
if (!haveStart) {
120-
out.append(" start=").append(msg.getTimestamp().getMillis());
121-
}
122-
123-
if (!haveMsg) {
124-
out.append(" msg=").append(escape(msg.getMessage(), true));
125-
}
126-
127-
if (!haveExternalId) {
128-
out.append(" externalId=").append(msg.getId());
112+
113+
if (!haveStart && k.equals("start")) {
114+
haveStart = true;
115+
}
116+
}
117+
}
118+
119+
if (!haveStart) {
120+
out.append(" start=").append(msg.getTimestamp().getMillis());
121+
}
122+
123+
if (!haveMsg) {
124+
out.append(" msg=").append(escape(msg.getMessage(), true));
129125
}
130126

131-
syslog.log(level, out.toString());
132-
}
133-
134-
public String escape(String s, boolean extension) {
135-
s = s.replace("\\", "\\\\");
127+
if (!haveExternalId) {
128+
out.append(" externalId=").append(msg.getId());
129+
}
130+
131+
syslog.log(level, out.toString());
132+
}
133+
134+
public String escape(String s, boolean extension) {
135+
s = s.replace("\\", "\\\\");
136136
if (extension) {
137137
s = s.replace("=", "\\=");
138138
s = s.replace("\r", "");
139-
s = s.replace("\n", "\\n");
140-
} else {
141-
s = s.replace("|", "\\|");
142-
s = s.replace("\r", "");
143-
s = s.replace("\n", "");
144-
}
145-
return s;
146-
}
147-
}
139+
s = s.replace("\n", "\\n");
140+
} else {
141+
s = s.replace("|", "\\|");
142+
s = s.replace("\r", "");
143+
s = s.replace("\n", "");
144+
}
145+
return s;
146+
}
147+
}

0 commit comments

Comments
 (0)