{"id":26740,"date":"2025-04-19T16:56:33","date_gmt":"2025-04-19T08:56:33","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/26740.html"},"modified":"2025-04-19T16:56:33","modified_gmt":"2025-04-19T08:56:33","slug":"%e9%9b%86%e4%b8%ad%e7%ae%a1%e7%90%86%e4%b8%8e%e5%ae%9e%e6%97%b6%e5%ae%a1%e8%ae%a1%ef%bc%9a%e6%9e%84%e5%bb%balinux%e9%9b%86%e7%be%a4%ef%bc%881300%e5%8f%b0%e6%9c%8d%e5%8a%a1%e5%99%a8%ef%bc%89%e6%97%a5","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/26740.html","title":{"rendered":"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5"},"content":{"rendered":"

\u7b80\u4ecb<\/h3>\n

\u968f\u7740\u4f01\u4e1aIT\u57fa\u7840\u8bbe\u65bd\u7684\u4e0d\u65ad\u6269\u5927，Linux\u670d\u52a1\u5668\u7684\u6570\u91cf\u4e5f\u65e5\u76ca\u589e\u591a，\u4f20\u7edf\u7684\u5355\u673a\u65e5\u5fd7\u7ba1\u7406\u65b9\u5f0f\u5df2\u65e0\u6cd5\u6ee1\u8db3\u5bf9\u65e5\u5fd7\u6570\u636e\u96c6\u4e2d\u7ba1\u7406\u3001\u5ba1\u8ba1\u548c\u5206\u6790\u7684\u9700\u6c42\u3002\u5c24\u5176\u662f\u5728\u5927\u578b\u96c6\u7fa4\u73af\u5883\u4e2d，\u5982\u4f55\u9ad8\u6548\u5730\u6536\u96c6\u3001\u5b58\u50a8\u548c\u5206\u6790\u65e5\u5fd7\u6210\u4e3a\u4e86\u4e00\u9879\u91cd\u8981\u7684\u6280\u672f\u6311\u6218\u3002<\/p>\n

\u80cc\u666f<\/h3>\n

\u5728\u5b9e\u73b0\u5bf9\u5927\u578bLinux\u96c6\u7fa4\u7684\u65e5\u5fd7\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5ba1\u8ba1，\u7279\u522b\u662f\u9488\u5bf9rsyslog\u65e5\u5fd7\u7684\u6536\u96c6\u3001\u64cd\u4f5c\u547d\u4ee4\u65e5\u5fd7\u4ee5\u53ca\u767b\u5f55\u65e5\u5fd7\u7684\u5ba1\u8ba1\u3002\u901a\u8fc7\u90e8\u7f72\u96c6\u4e2d\u7684rsyslog\u670d\u52a1\u7aef，\u80fd\u591f\u7edf\u4e00\u6536\u96c61300\u591a\u53f0Linux\u670d\u52a1\u5668\u7684\u7cfb\u7edf\u65e5\u5fd7，\u786e\u4fdd\u65e5\u5fd7\u6570\u636e\u7684\u96c6\u4e2d\u5316\u7ba1\u7406\u3002\u4f7f\u7528Filebeat\u4f5c\u4e3a\u65e5\u5fd7\u6536\u96c6\u5de5\u5177，\u5c06\u65e5\u5fd7\u6570\u636e\u63a8\u9001\u81f3Logstash\u8fdb\u884c\u6e05\u6d17\u548c\u8f6c\u6362，\u6700\u7ec8\u5b58\u50a8\u5230Elasticsearch\u4e2d，\u5e76\u901a\u8fc7Kibana\u5b9e\u73b0\u5b9e\u65f6\u6570\u636e\u53ef\u89c6\u5316\u5c55\u793a\u3002\u8fd9\u79cd\u65b9\u5f0f\u4e0d\u4ec5\u7b80\u5316\u4e86\u65e5\u5fd7\u7ba1\u7406\u6d41\u7a0b，\u8fd8\u63d0\u9ad8\u4e86\u7cfb\u7edf\u7684\u76d1\u63a7\u6548\u7387\u548c\u5b89\u5168\u6027\u3002<\/p>\n

\u9700\u6c42<\/h3>\n

\u7edf\u4e00\u7ba1\u7406 1300 \u53f0\u670d\u52a1\u5668\u7684Linux\u7cfb\u7edf\u65e5\u5fd7，\u80fd\u591f\u53ca\u65f6\u53d1\u73b0\u95ee\u9898\u548c\u544a\u8b66\u3002 \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

\u89e3\u51b3\u65b9\u6848<\/h3>\n
  • \u96c6\u4e2d\u7ba1\u7406：\u901a\u8fc7\u7edf\u4e00\u7684\u670d\u52a1\u7aef\u6536\u96c6\u6240\u6709Linux\u670d\u52a1\u5668\u7684\u65e5\u5fd7\u6570\u636e，\u51cf\u5c11\u5355\u72ec\u914d\u7f6e\u6bcf\u53f0\u670d\u52a1\u5668\u7684\u5de5\u4f5c\u91cf\u3002<\/li>\n
  • \u65e5\u5fd7\u5ba1\u8ba1：\u5bf9\u64cd\u4f5c\u547d\u4ee4\u65e5\u5fd7\u3001\u767b\u5f55\u65e5\u5fd7\u7b49\u8fdb\u884c\u5ba1\u8ba1，\u786e\u4fdd\u7cfb\u7edf\u884c\u4e3a\u7684\u53ef\u8ffd\u6eaf\u6027\u3002<\/li>\n
  • \u6570\u636e\u6e05\u6d17\u4e0e\u5206\u6790：\u901a\u8fc7\u65e5\u5fd7\u6e05\u6d17\u4e0e\u683c\u5f0f\u8f6c\u6362，\u786e\u4fdd\u65e5\u5fd7\u6570\u636e\u7684\u6807\u51c6\u5316，\u4fbf\u4e8e\u540e\u7eed\u7684\u5206\u6790\u548c\u53ef\u89c6\u5316\u5c55\u793a\u3002<\/li>\n
  • \u5b9e\u65f6\u5c55\u793a：\u5229\u7528Kibana\u5c06\u6e05\u6d17\u540e\u7684\u6570\u636e\u5b9e\u65f6\u53ef\u89c6\u5316，\u5e2e\u52a9\u8fd0\u7ef4\u4eba\u5458\u5feb\u901f\u53d1\u73b0\u6f5c\u5728\u95ee\u9898\u3002<\/li>\n

    \u6574\u4f53\u67b6\u6784<\/h3>\n

    \u4e3a\u5b9e\u73b0\u8fd9\u4e9b\u76ee\u6807，\u6211\u4eec\u8bbe\u8ba1\u4e86\u4ee5\u4e0b\u7684\u7cfb\u7edf\u67b6\u6784：<\/p>\n

      \n
    • rsyslog：\u4f5c\u4e3a\u65e5\u5fd7\u6536\u96c6\u7684\u6838\u5fc3\u7ec4\u4ef6，\u5b83\u8d1f\u8d23\u5c06\u6765\u81eaLinux\u7cfb\u7edf\u7684\u5404\u79cd\u65e5\u5fd7（\u5305\u62ec\/var\/log\/messages\u7b49）\u7edf\u4e00\u63a8\u9001\u5230\u4e2d\u5fc3\u5316\u7684\u65e5\u5fd7\u670d\u52a1\u7aef\u3002<\/li>\n
    • Filebeat：\u4f5c\u4e3a\u8f7b\u91cf\u7ea7\u7684\u65e5\u5fd7\u6536\u96c6\u5668，\u90e8\u7f72\u5728\u5404\u4e2aLinux\u8282\u70b9\u4e0a，\u8d1f\u8d23\u5c06\u65e5\u5fd7\u6587\u4ef6\u4f20\u8f93\u5230Logstash\u3002<\/li>\n
    • Logstash：\u5bf9\u6536\u96c6\u5230\u7684\u65e5\u5fd7\u8fdb\u884c\u6e05\u6d17\u3001\u89e3\u6790\u548c\u8f6c\u6362，\u786e\u4fdd\u6570\u636e\u7b26\u5408\u9884\u5b9a\u683c\u5f0f，\u4fbf\u4e8e\u5b58\u5165Elasticsearch\u3002<\/li>\n
    • Elasticsearch：\u5b58\u50a8\u7ecf\u8fc7\u6e05\u6d17\u548c\u8f6c\u6362\u7684\u65e5\u5fd7\u6570\u636e，\u63d0\u4f9b\u5f3a\u5927\u7684\u5168\u6587\u641c\u7d22\u548c\u6570\u636e\u67e5\u8be2\u529f\u80fd\u3002<\/li>\n
    • Kibana：\u901a\u8fc7Kibana\u4eea\u8868\u76d8\u5b9e\u65f6\u5c55\u793a\u5b58\u50a8\u5728Elasticsearch\u4e2d\u7684\u65e5\u5fd7\u6570\u636e，\u5e2e\u52a9\u8fd0\u7ef4\u4eba\u5458\u8fdb\u884c\u6570\u636e\u5206\u6790\u548c\u53ef\u89c6\u5316\u5c55\u793a\u3002<\/li>\n<\/ul>\n

      rsyslog\u6c47\u603b<\/h3>\n

      rsyslog\u670d\u52a1\u7aef<\/h4>\n

      \u9996\u5148\u914d\u7f6ersyslog\u670d\u52a1\u5668，\u53ef\u4ee5\u7edf\u4e00\u6536\u96c6\u96c6\u7fa4\u5185\u90e8\u7684\u65e5\u5fd7\u3002<\/p>\n

      # \u52a0\u8f7d\u672c\u5730\u7cfb\u7edf\u65e5\u5fd7\u6a21\u5757（\u4f8b\u5982\u901a\u8fc7 logger \u547d\u4ee4\u53d1\u9001\u7684\u65e5\u5fd7）<\/span>
      \n$ModLoad<\/span> imuxsock
      \n# \u52a0\u8f7d\u5185\u6838\u65e5\u5fd7\u6a21\u5757（\u4e4b\u524d\u7531 rklogd \u5904\u7406）<\/span>
      \n$ModLoad<\/span> imklog
      \n# \u52a0\u8f7d UDP \u6a21\u5757，\u652f\u6301\u901a\u8fc7 UDP \u534f\u8bae\u63a5\u6536\u65e5\u5fd7<\/span>
      \n$ModLoad<\/span> imudp
      \n# \u914d\u7f6e UDP \u670d\u52a1\u5668\u5728 514 \u7aef\u53e3\u63a5\u6536\u65e5\u5fd7<\/span>
      \n$UDPServerRun<\/span> 514<\/span>
      \n# \u52a0\u8f7d TCP \u6a21\u5757，\u652f\u6301\u901a\u8fc7 TCP \u534f\u8bae\u63a5\u6536\u65e5\u5fd7<\/span>
      \n$ModLoad<\/span> imtcp
      \n# \u914d\u7f6e TCP \u670d\u52a1\u5668\u5728 514 \u7aef\u53e3\u63a5\u6536\u65e5\u5fd7<\/span>
      \n$InputTCPServerRun<\/span> 514<\/span>
      \n# \u5b9a\u4e49\u4e00\u4e2a\u81ea\u5b9a\u4e49\u7684\u65e5\u5fd7\u683c\u5f0f\u6a21\u677f 'myFormat'<\/span>
      \n$template<\/span> myFormat,"%timestamp:::date-rfc3339% %fromhost-ip% %HOSTNAME% [%programname%] %syslogseverity-text%:%msg%\\\\n<\/span>"<\/span>
      \n# \u8bbe\u7f6e\u9ed8\u8ba4\u7684\u6587\u4ef6\u683c\u5f0f\u4e3a\u4f20\u7edf\u7684 rsyslog \u683c\u5f0f<\/span>
      \n$ActionFileDefaultTemplate<\/span> RSYSLOG_TraditionalFileFormat
      \n# \u52a0\u8f7d \/etc\/rsyslog.d\/ \u76ee\u5f55\u4e0b\u7684\u6240\u6709\u914d\u7f6e\u6587\u4ef6<\/span>
      \n$IncludeConfig<\/span> \/etc\/rsyslog.d\/*.conf
      \n# \u914d\u7f6e\u6536\u96c6 info \u7ea7\u522b\u7684\u65e5\u5fd7，\u6392\u9664 mail\u3001authpriv\u3001cron \u7c7b\u522b\u7684\u65e5\u5fd7，\u8f93\u51fa\u5230 \/var\/log\/messages \u6587\u4ef6，\u5e76\u4f7f\u7528 myFormat \u683c\u5f0f<\/span>
      \n*.info;<\/span>mail.none;<\/span>authpriv.none;<\/span>cron.none \/var\/log\/messages;<\/span>myFormat
      \n# \u6536\u96c6\u6240\u6709 authpriv \u7c7b\u522b\u7684\u65e5\u5fd7（\u901a\u5e38\u662f\u8ba4\u8bc1\u76f8\u5173\u7684\u65e5\u5fd7），\u8f93\u51fa\u5230 \/var\/log\/secure \u6587\u4ef6，\u5e76\u4f7f\u7528 myFormat \u683c\u5f0f<\/span>
      \nauthpriv.* \/var\/log\/secure;<\/span>myFormat
      \n# \u6536\u96c6\u6240\u6709 mail \u7c7b\u522b\u7684\u65e5\u5fd7，\u8f93\u51fa\u5230 \/var\/log\/maillog \u6587\u4ef6，\u4f7f\u7528\u5f02\u6b65\u5199\u5165（- \u8868\u793a\u5f02\u6b65）<\/span>
      \nmail.* -\/var\/log\/maillog
      \n# \u6536\u96c6\u6240\u6709 cron \u7c7b\u522b\u7684\u65e5\u5fd7（\u5b9a\u65f6\u4efb\u52a1\u65e5\u5fd7），\u8f93\u51fa\u5230 \/var\/log\/cron \u6587\u4ef6<\/span>
      \ncron.* \/var\/log\/cron
      \n# \u6536\u96c6\u6240\u6709\u7d27\u6025\u7ea7\u522b（emerg）\u7684\u65e5\u5fd7，\u5c06\u5176\u901a\u8fc7\u7cfb\u7edf\u6d88\u606f\u53d1\u9001<\/span>
      \n*.emerg :omusrmsg:*
      \n# \u6536\u96c6 uucp \u548c news \u7c7b\u522b\u7684\u4e25\u91cd\u7ea7\u522b（crit）\u65e5\u5fd7，\u8f93\u51fa\u5230 \/var\/log\/spooler \u6587\u4ef6<\/span>
      \nuucp,news.crit \/var\/log\/spooler
      \n# \u6536\u96c6\u6240\u6709 local7 \u7c7b\u522b\u7684\u65e5\u5fd7，\u8f93\u51fa\u5230 \/var\/log\/boot.log \u6587\u4ef6<\/span>
      \nlocal7.* \/var\/log\/boot.log<\/p>\n

      \u91cd\u542f\u670d\u52a1\u7aef<\/p>\n

      systemctl restart rsyslog<\/p>\n

      \u4fee\u6539\u524d： \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      \u4fee\u6539\u540e： \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      rsyslog\u5ba2\u6237\u7aef<\/h4>\n

      \u6240\u6709\u96c6\u7fa4\u7684\u5ba2\u6237\u7aef\u914d\u7f6e\u6700\u540e\u4e00\u884cIP，\u5c31\u53ef\u4ee5\u628a\u6570\u636e\u6c47\u603b\u5728\u4e00\u5207<\/p>\n

      [<\/span>root@zabbix ~]<\/span># cat \/etc\/rsyslog.conf |tail -n 2<\/span>
      \n#authpriv.* @10.10.10.17<\/span>
      \n*.* @@192.168.102.20 # rsyslog \u670d\u52a1\u7aef\u7684IP<\/span><\/p>\n

      \u91cd\u542f<\/p>\n

      systemctl restart rsyslog.service<\/p>\n

      \u65e5\u5fd7\u5df2\u7ecf\u6253\u5370\u5230rsyslog \u670d\u52a1\u7aef\u7684 \/var\/log\/messages \/var\/log\/secure \u7b49\u6587\u4ef6<\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      filebeaet\u6536\u96c6<\/h4>\n

      \u5728rsyslog \u670d\u52a1\u7aef\u7684\u5b89\u88c5filebeaet，\u5e76\u4e14\u4f7f\u7528\u5982\u4e0b\u914d\u7f6e\u542f\u52a8<\/p>\n

      filebeat.config.modules:
      \n path: ${path.config}<\/span>\/modules.d\/*.yml
      \n reload.enabled: false<\/span>
      \nfilebeat.inputs:
      \n– type: log
      \n enabled: true<\/span>
      \n tail_files: true<\/span>
      \n paths:
      \n – \/var\/log\/messages
      \noutput.logstash:
      \n hosts: [<\/span>"192.168.1.100:5514"<\/span>]<\/span>
      \n # \u628a\u65e5\u5fd7\u53d1\u9001\u5230logstatsh\u4e2d<\/span><\/p>\n

      logstatsh\u914d\u7f6e<\/h4>\n

      [<\/span>root@game logstash]<\/span># cat config\/rsyslog.conf<\/span>
      \ninput {<\/span>
      \n beats {<\/span>
      \n port =<\/span>><\/span> 5514<\/span>
      \n type<\/span> =<\/span>><\/span> syslog
      \n }<\/span>
      \n}<\/span><\/p>\n

      filter {<\/span>
      \n grok {<\/span>
      \n match =<\/span>><\/span> {<\/span>
      \n"message"<\/span> =<\/span>><\/span> "%{TIMESTAMP_ISO8601:time} %{IP:client_ip} %{HOSTNAME:host_name} \\\\[%{DATA:type}\\\\] %{GREEDYDATA:info}"<\/span>
      \n}<\/span>
      \noverwrite =<\/span>><\/span> [<\/span>"message"<\/span>]<\/span><\/p>\n

      }<\/span>
      \nmutate {<\/span>
      \nsplit<\/span> =<\/span>><\/span> [<\/span>"type"<\/span>,","<\/span>]<\/span>
      \n}<\/span>
      \nmutate{<\/span>
      \n add_field =<\/span>><\/span> {<\/span>
      \n "types"<\/span> =<\/span>><\/span> "%{[type][1]}"<\/span>
      \n}<\/span> }<\/span>
      \n mutate{<\/span>remove_field =<\/span>><\/span> [<\/span> "tags"<\/span>,"agent"<\/span>,"host"<\/span>,"log"<\/span>,"ecs"<\/span>,"type"<\/span> ]<\/span>}<\/span><\/p>\n

      date<\/span> {<\/span>
      \n match =<\/span>><\/span> [<\/span>"time"<\/span>, "yyyy-MM-dd HH:mm:ss,SSS"<\/span>, "UNIX"<\/span>]<\/span>
      \n target =<\/span>><\/span> "@timestamp"<\/span>
      \n locale =<\/span>><\/span> "cn"<\/span>
      \n }<\/span>
      \n}<\/span><\/p>\n

      output {<\/span>
      \n stdout {<\/span>
      \n codec<\/span>=<\/span>><\/span> rubydebug
      \n }<\/span>
      \n elasticsearch {<\/span>
      \n hosts =<\/span>><\/span> [<\/span>"127.0.0.1:9200"<\/span>]<\/span>
      \n index =<\/span>><\/span> "message"<\/span>
      \n }<\/span>
      \n}<\/span><\/p>\n

      \u6570\u636e\u683c\u5f0f<\/p>\n

      2024<\/span>-12-03T18:35:30+08:00 192.168<\/span>.102.30 master01 [<\/span>kubelet]<\/span> info: E1203 18<\/span>:35:30.827608 1065<\/span> summary_sys_containers.go:83]<\/span> "Failed to get system container stats"<\/span> err<\/span>=<\/span>"failed to get cgroup stats for \\\\"<\/span>\/system.slice\/docker.service\\\\"<\/span>: failed to get container info for \\\\"<\/span>\/system.slice\/docker.service\\\\"<\/span>: unknown container \\\\"<\/span>\/system.slice\/docker.service\\\\"<\/span>"<\/span> containerName<\/span>=<\/span>"\/system.slice\/docker.service"<\/span><\/p>\n

      GROK\u89e3\u6790<\/p>\n

      %{<\/span>TIMESTAMP_ISO8601:time}<\/span> %{<\/span>IP:client_ip}<\/span> %{<\/span>HOSTNAME<\/span>:host_name}<\/span> \\\\<\/span>[<\/span>%{<\/span>DATA:type}<\/span>\\\\<\/span>]<\/span> %{<\/span>GREEDYDATA:info}<\/span><\/p>\n

      \u8f93\u51fa\u683c\u5f0f<\/p>\n

      {<\/span>
      \n "client_ip"<\/span>:<\/span> "192.168.102.30"<\/span>,
      \n "time"<\/span>:<\/span> "2024-12-03T18:35:30+08:00"<\/span>,
      \n "type"<\/span>:<\/span> "kubelet"<\/span>,
      \n "host_name"<\/span>:<\/span> "master01"<\/span>,
      \n "info"<\/span>:<\/span> "info: E1203 18:35:30.827608 1065 summary_sys_containers.go:83] \\\\"<\/span>Failed to get system container stats\\\\"<\/span> err=\\\\"<\/span>failed to get cgroup stats for \\\\\\\\<\/span>\\\\"<\/span>\/system.slice\/docker.service\\\\\\\\<\/span>\\\\"<\/span>: failed to get container info for \\\\\\\\<\/span>\\\\"<\/span>\/system.slice\/docker.service\\\\\\\\<\/span>\\\\"<\/span>: unknown container \\\\\\\\<\/span>\\\\"<\/span>\/system.slice\/docker.service\\\\\\\\<\/span>\\\\"<\/span>\\\\"<\/span> containerName=\\\\"<\/span>\/system.slice\/docker.service\\\\"<\/span>\\\\r<\/span>"<\/span>
      \n}<\/span><\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      \u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u5ba1\u8ba1<\/h3>\n

      Linux\u4e00\u822c\u90fd\u662f\u7ec8\u7aef\u6267\u884c\u547d\u4ee4，\u6211\u4eec\u53ef\u4ee5\u8ba9\u547d\u4ee4\u5199\u5230message\u65e5\u5fd7\u4e0a，\u5728\u901a\u8fc7\u8fc7\u6ee4，\u83b7\u53d6\u64cd\u4f5c\u547d\u4ee4\u8bb0\u5f55\u3002<\/p>\n

      Linux\u7ec8\u7aef\u914d\u7f6e<\/h4>\n

      [<\/span>root@zabbix ~]<\/span># cat \/etc\/profile | tail -n 2<\/span>
      \nunset<\/span> MAILCHECK<\/span>
      \nexport<\/span> PROMPT_COMMAND<\/span>=<\/span>'{ msg=$(history 1 | { read x y; echo $y; });logger -p local2.info "euid=$(whoami)" $(who am i) `pwd` "$msg"; }'<\/span><\/p>\n

      \u65e5\u5fd7\u683c\u5f0f
      \nOct 11<\/span> 17<\/span>:32:41 zabbix root: euid<\/span>=<\/span>root root pts\/0 2021<\/span>-10-11 15<\/span>:13 (<\/span>10.10<\/span>.10.3)<\/span> \/root cat<\/span> \/etc\/profile
      \nOct 11<\/span> 17<\/span>:32:47 zabbix root: euid<\/span>=<\/span>root root pts\/0 2021<\/span>-10-11 15<\/span>:13 (<\/span>10.10<\/span>.10.3)<\/span> \/root cat<\/span> \/etc\/profile |<\/span> tail<\/span> -n<\/span> 2<\/span><\/p>\n

      rsyslog\u670d\u52a1\u7aef\u5c55\u793a \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      filebeat\u914d\u7f6e<\/h4>\n

      [<\/span>root@logserver01 filebeat]<\/span># cat system_messages.yml <\/span>
      \n#=========================== Filebeat inputs =============================<\/span>
      \nfilebeat.inputs:
      \n– type: log
      \n enabled: true<\/span>
      \n tail_files: true<\/span>
      \n paths:
      \n – \/var\/log\/messages<\/p>\n

      logstatsh\u914d\u7f6e<\/h4>\n

      [<\/span>root@logserver01 config]<\/span># cat system_userlog_FromKafkaInES.conf<\/span>
      \ninput{<\/span>
      \n beats {<\/span>
      \n host<\/span> =<\/span>><\/span> '172.17.9.200'<\/span>
      \n port =<\/span>><\/span> 5046<\/span>
      \n }<\/span><\/p>\n

      #kafka{<\/span>
      \n#bootstrap_servers => ["172.17.8.232:6667"]<\/span>
      \n#topics => ["sys_os_exe"]<\/span>
      \n#codec => "json"<\/span>
      \n#group_id => "ELK_SYSTEM_EXE_GROUP"<\/span>
      \n#consumer_threads => 3<\/span>
      \n#client_id => "logstash"<\/span>
      \n#decorate_events => false<\/span>
      \n#auto_offset_reset => "earliest"<\/span>
      \n#request_timeout_ms => "300000"<\/span>
      \n#session_timeout_ms => "20000"<\/span>
      \n#max_poll_interval_ms => "600000"<\/span>
      \n#}<\/span>
      \n}<\/span>
      \nfilter{<\/span>
      \nif<\/span> (<\/span>[<\/span>message]<\/span> =~<\/span> "euid"<\/span>)<\/span>{<\/span>
      \ngrok{<\/span>
      \nmatch =<\/span>><\/span> {<\/span>"message"<\/span> =<\/span>><\/span> '^(?<exetime>\\\\d+-\\\\d+-\\\\d+)(?:[^\\\\d]+)(?<hhmmss>\\\\d+:\\\\d+:\\\\d+)(?:[^\\\\d]+\\\\d+:\\\\d+)(?:\\\\s)(?<deshost>[^ ]+)(?:\\\\s)(?<name>[^ ]+)(?:\\\\s\\\\[)(?<loginuser>[^ |\\\\]]*)(?:\\\\]\\\\s[^ ]+\\\\seuid=)(?<exeuser>[^ ]+)(?:\\\\s+)(?<userinfo>[^\\\\(]+)(?:\\\\s\\\\()(?<srchost>[^\\\\)]+)(?:\\\\)\\\\s)(?<exepath>[^ ]+)(\\\\s+)(?<exeinfo>.*)'<\/span>}<\/span>
      \n}<\/span>
      \nif<\/span> "_grokparsefailure"<\/span> in<\/span> [<\/span>tags]<\/span> {<\/span> drop {<\/span> }<\/span> }<\/span>
      \nmutate{<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"tmp_exeinfo"<\/span>,"%{exeinfo}"<\/span>]<\/span>
      \n}<\/span>
      \nmutate{<\/span>
      \nsplit<\/span> =<\/span>><\/span> [<\/span>"exetime"<\/span>,"-"<\/span>]<\/span>
      \nsplit<\/span> =<\/span>><\/span> [<\/span>"tmp_exeinfo"<\/span>," "<\/span>]<\/span>
      \n }<\/span>
      \nmutate{<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"indextime"<\/span>,"%{[exetime][0]}%{[exetime][1]}"<\/span>]<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"%{[exetime][0]}-%{[exetime][1]}-%{[exetime][2]} %{hhmmss}"<\/span>]<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"cmd"<\/span>,"%{[tmp_exeinfo][0]}"<\/span>]<\/span><\/p>\n

      }<\/span>
      \n#Retention log insertion time to ES…………..<\/span>
      \nruby {<\/span> code =<\/span>><\/span> "event.set('inserttime', event.get('@timestamp').time.to_i)"<\/span> }<\/span>
      \n#replace InsertTime with evtTime "yyyy-MM-dd HH:mm:ss eg:2020-06-29 09:24:29"<\/span>
      \ndate{<\/span>
      \n match =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"yyyy-MM-dd HH:mm:ss"<\/span>]<\/span>
      \n #kibana use this time………………..<\/span>
      \ntarget =<\/span>><\/span> "@timestamp"<\/span>
      \n }<\/span>
      \nmutate{<\/span>replace =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"%{evtTime} +0800"<\/span>]<\/span>}<\/span>
      \ndate{<\/span>
      \nmatch =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"yyyy-MM-dd HH:mm:ss +0800"<\/span>]<\/span>
      \n timezone =<\/span>><\/span>"UTC"<\/span>
      \n#log event time timestamp…………….<\/span>
      \n target =<\/span>><\/span> "logtimestamp"<\/span>
      \n }<\/span>
      \n#log event time long string………………….<\/span>
      \nruby {<\/span> code =<\/span>><\/span> "event.set('longtime', event.get('logtimestamp').time.to_i)"<\/span> }<\/span><\/p>\n

      mutate{<\/span>remove_field =<\/span>><\/span> [<\/span> "tmp_exeinfo"<\/span>,"evtTime"<\/span>,"host"<\/span>,"ecs"<\/span>,"log"<\/span>,"hhmmss"<\/span>,"input"<\/span>,"agent"<\/span>,"exetime"<\/span> ]<\/span>}<\/span>
      \n}<\/span>
      \nelse{<\/span>
      \n drop{<\/span>}<\/span>
      \n }<\/span>
      \n}<\/span>
      \noutput{<\/span>
      \nstdout{<\/span>codec =<\/span>><\/span> rubydebug}<\/span>
      \nif<\/span> [<\/span>indextime]<\/span> !<\/span>~ "index"<\/span>{<\/span>
      \nelasticsearch{<\/span>
      \nhosts =<\/span>><\/span> [<\/span>"http:\/\/172.17.9.176:9200"<\/span>]<\/span>
      \n#hosts => "172.17.9.176"<\/span>
      \nindex =<\/span>><\/span> "sys_os_userlog_%{[indextime]}"<\/span>
      \n user =<\/span>><\/span> "*********"<\/span>
      \n password =<\/span>><\/span> "*********"<\/span>
      \n}<\/span>
      \n}<\/span>
      \n}<\/span><\/p>\n

      \u6570\u636e\u683c\u5f0f<\/p>\n

      2024<\/span>-12-03T18:39:05+08:00 192.168<\/span>.102.30 master01 [<\/span>root]<\/span> info: euid<\/span>=<\/span>root root pts\/0 2024<\/span>-12-03 18<\/span>:21 (<\/span>192.168<\/span>.96.19)<\/span> \/root [<\/span>2024<\/span>-12-03 18<\/span>:39:05]<\/span>ip a<\/p>\n

      GROK\u89e3\u6790<\/p>\n

      ^(<\/span>?<<\/span>exetime><\/span>\\\\<\/span>d+-\\\\<\/span>d+-\\\\<\/span>d+)<\/span>(<\/span>?:[<\/span>^\\\\<\/span>d]<\/span>+)<\/span>(<\/span>?<<\/span>hhmmss><\/span>\\\\<\/span>d+:\\\\<\/span>d+:\\\\<\/span>d+)<\/span>(<\/span>?:[<\/span>^\\\\<\/span>d]<\/span>+\\\\<\/span>d+:\\\\<\/span>d+)<\/span>(<\/span>?:\\\\<\/span>s)<\/span>(<\/span>?<<\/span>deshost><\/span>[<\/span>^ ]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>s)<\/span>(<\/span>?<<\/span>name><\/span>[<\/span>^ ]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>s\\\\<\/span>[<\/span>)<\/span>(<\/span>?<<\/span>loginuser><\/span>[<\/span>^ |<\/span>\\\\<\/span>]<\/span>]<\/span>*)<\/span>(<\/span>?:\\\\<\/span>]<\/span>\\\\<\/span>s[<\/span>^ ]<\/span>+\\\\<\/span>seuid=<\/span>)<\/span>(<\/span>?<<\/span>exeuser><\/span>[<\/span>^ ]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>s+)<\/span>(<\/span>?<<\/span>userinfo><\/span>[<\/span>^\\\\<\/span>(<\/span>]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>s\\\\<\/span>(<\/span>)<\/span>(<\/span>?<<\/span>srchost><\/span>[<\/span>^\\\\<\/span>)<\/span>]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>)<\/span>\\\\<\/span>s)<\/span>(<\/span>?<<\/span>exepath><\/span>[<\/span>^ ]<\/span>+)<\/span>(<\/span>\\\\<\/span>s+)<\/span>(<\/span>?<<\/span>exeinfo><\/span>.*)<\/span><\/p>\n

      \u8f93\u51fa\u683c\u5f0f<\/p>\n

      {<\/span>
      \n "loginuser"<\/span>:<\/span> "root"<\/span>,
      \n "hhmmss"<\/span>:<\/span> "18:39:05"<\/span>,
      \n "exepath"<\/span>:<\/span> "\/root"<\/span>,
      \n "deshost"<\/span>:<\/span> "192.168.102.30"<\/span>,
      \n "srchost"<\/span>:<\/span> "192.168.96.19"<\/span>,
      \n "name"<\/span>:<\/span> "master01"<\/span>,
      \n "exeinfo"<\/span>:<\/span> "[2024-12-03 18:39:05]ip a\\\\r<\/span>"<\/span>,
      \n "exeuser"<\/span>:<\/span> "root"<\/span>,
      \n "userinfo"<\/span>:<\/span> "root pts\/0 2024-12-03 18:21"<\/span>,
      \n "exetime"<\/span>:<\/span> "2024-12-03"<\/span>
      \n}<\/span><\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      \u7cfb\u7edf\u7528\u6237\u767b\u5f55\u5ba1\u8ba1<\/h3>\n

      filebeat\u914d\u7f6e<\/h4>\n

      [<\/span>root@logserver01 filebeat]<\/span># cat system_secure.yml<\/span>
      \n#=========================== Filebeat inputs =============================<\/span>
      \nfilebeat.inputs:
      \n– type: log
      \n enabled: true<\/span>
      \n tail_files: true<\/span>
      \n paths:
      \n – \/var\/log\/secure
      \n#=========================== Filebeat outppp_id: messuts =============================<\/span>
      \noutput.logstash:
      \n hosts: [<\/span>"172.17.9.200:5045"<\/span>]<\/span><\/p>\n

      logstatsh\u914d\u7f6e<\/h4>\n

      [<\/span>root@logserver01 config]<\/span># cat system_login_FromKafkaInES.conf<\/span>
      \ninput{<\/span>
      \n beats {<\/span>
      \n host<\/span> =<\/span>><\/span> '172.17.9.200'<\/span>
      \n port =<\/span>><\/span> 5045<\/span>
      \n }<\/span><\/p>\n

      #<\/span>
      \n#kafka{<\/span>
      \n#bootstrap_servers => ["172.17.8.232:6667"]<\/span>
      \n#topics => ["sys_os_login"]<\/span>
      \n#codec => "json"<\/span>
      \n#group_id => "ELK_SYSTEM_LOGIN_GROUP"<\/span>
      \n#consumer_threads => 3<\/span>
      \n#client_id => "logstash"<\/span>
      \n#decorate_events => false<\/span>
      \n#auto_offset_reset => "earliest"<\/span>
      \n#request_timeout_ms => "300000"<\/span>
      \n#session_timeout_ms => "20000"<\/span>
      \n#max_poll_interval_ms => "600000"<\/span>
      \n#}<\/span>
      \n}<\/span>
      \nfilter{<\/span>
      \n#login successed log<\/span>
      \nif<\/span> (<\/span>[<\/span>message]<\/span> =~<\/span> "Accepted"<\/span>)<\/span>{<\/span>
      \ngrok{<\/span>
      \nmatch =<\/span>><\/span> {<\/span>"message"<\/span> =<\/span>><\/span> '^(?<atime>\\\\d+-\\\\d+-\\\\d+)(?:[^\\\\d]+)(?<hhmmss>\\\\d+:\\\\d+:\\\\d+)(?:[^\\\\d]+\\\\d+:\\\\d+)(?:\\\\s+)(?<deshost>\\\\d+\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+)(?:\\\\s)(?<name>[^ ]+)(?:[\\\\S\\\\s]*Failed\\\\spassword\\\\sfor[\\\\sinvalid\\\\suser]*\\\\s)(?<loginuser>[^ ]+)(?:\\\\sfrom\\\\s)(?<srchost>[\\\\d.]+)(?:\\\\s\\\\w+\\\\s\\\\d+\\\\s)(?<loginmode>\\\\w*)'<\/span>}<\/span>
      \n}<\/span>
      \nif<\/span> "_grokparsefailure"<\/span> in<\/span> [<\/span>tags]<\/span> {<\/span> drop {<\/span> }<\/span> }<\/span>
      \nmutate{<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"type"<\/span>,"systemlogin"<\/span>]<\/span>
      \nsplit<\/span> =<\/span>><\/span> [<\/span>"atime"<\/span>,"-"<\/span>]<\/span>
      \n }<\/span>
      \nmutate{<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"indextime"<\/span>,"%{[atime][0]}%{[atime][1]}"<\/span>]<\/span>
      \nadd_field =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"%{[atime][0]}-%{[atime][1]}-%{[atime][2]} %{hhmmss}"<\/span>]<\/span>
      \n}<\/span>
      \n#Retention log insertion time to ES…………..<\/span>
      \nruby {<\/span> code =<\/span>><\/span> "event.set('inserttime', event.get('@timestamp').time.to_i)"<\/span> }<\/span><\/p>\n

      #replace InsertTime with evtTime "yyyy-MM-dd HH:mm:ss eg:2020-06-29 09:24:29"<\/span>
      \ndate{<\/span>
      \n match =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"yyyy-MM-dd HH:mm:ss"<\/span>]<\/span>
      \n #kibana use this time………………..<\/span>
      \ntarget =<\/span>><\/span> "@timestamp"<\/span>
      \n }<\/span>
      \nmutate{<\/span>replace =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"%{evtTime} +0800"<\/span>]<\/span>}<\/span>
      \ndate{<\/span>
      \nmatch =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"yyyy-MM-dd HH:mm:ss +0800"<\/span>]<\/span>
      \n timezone =<\/span>><\/span>"UTC"<\/span>
      \n#log event time timestamp…………….<\/span>
      \n target =<\/span>><\/span> "logtimestamp"<\/span>
      \n }<\/span>
      \n#log event time long string………………….<\/span>
      \nruby {<\/span> code =<\/span>><\/span> "event.set('longtime', event.get('logtimestamp').time.to_i)"<\/span> }<\/span>
      \nmutate{<\/span>remove_field =<\/span>><\/span> [<\/span> "evtTime"<\/span>,"host"<\/span>,"ecs"<\/span>,"log"<\/span>,"hhmmss"<\/span>,"input"<\/span>,"agent"<\/span>,"atime"<\/span> ]<\/span>}<\/span>
      \n}<\/span>
      \n#login failed log<\/span>
      \nelse<\/span> if<\/span> (<\/span>[<\/span>message]<\/span> =~<\/span> "Failed password for"<\/span>)<\/span>{<\/span>
      \ngrok{<\/span>
      \nmatch =<\/span>><\/span> {<\/span>"message"<\/span> =<\/span>><\/span> '^(?<atime>\\\\d+-\\\\d+-\\\\d+)(?:[^\\\\d]+)(?<hhmmss>\\\\d+:\\\\d+:\\\\d+)(?:[^\\\\d]+\\\\d+:\\\\d+)(?:\\\\s+)(?<deshost>\\\\d+\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+)(?:[\\\\S\\\\s]*Failed\\\\spassword\\\\sfor[\\\\sinvalid\\\\suser]*\\\\s)(?<loginuser>[^ ]+)(?:\\\\sfrom\\\\s)(?<srchost>[\\\\d.]+)(?:\\\\s\\\\w+\\\\s\\\\d+\\\\s)(?<loginmode>\\\\w*)'<\/span>}<\/span>
      \n}<\/span>
      \nif<\/span> "_grokparsefailure"<\/span> in<\/span> [<\/span>tags]<\/span> {<\/span> drop {<\/span> }<\/span> }<\/span>
      \n mutate{<\/span>
      \n add_field =<\/span>><\/span> [<\/span>"type"<\/span>,"systemloginfailed"<\/span>]<\/span>
      \n split<\/span> =<\/span>><\/span> [<\/span>"atime"<\/span>,"-"<\/span>]<\/span>
      \n }<\/span>
      \n mutate{<\/span>
      \n add_field =<\/span>><\/span> [<\/span>"indextime"<\/span>,"%{[atime][0]}%{[atime][1]}"<\/span>]<\/span>
      \n add_field =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"%{[atime][0]}-%{[atime][1]}-%{[atime][2]} %{hhmmss}"<\/span>]<\/span>
      \n }<\/span>
      \n #Retention log insertion time to ES…………..<\/span>
      \n ruby {<\/span> code =<\/span>><\/span> "event.set('inserttime', event.get('@timestamp').time.to_i)"<\/span> }<\/span><\/p>\n

      #replace InsertTime with evtTime "yyyy-MM-dd HH:mm:ss eg:2020-06-29 09:24:29"<\/span>
      \n date{<\/span>
      \n match =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"yyyy-MM-dd HH:mm:ss"<\/span>]<\/span>
      \n #kibana use this time………………..<\/span>
      \n target =<\/span>><\/span> "@timestamp"<\/span>
      \n }<\/span>
      \n mutate{<\/span>replace =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"%{evtTime} +0800"<\/span>]<\/span>}<\/span>
      \n date{<\/span>
      \n match =<\/span>><\/span> [<\/span>"evtTime"<\/span>,"yyyy-MM-dd HH:mm:ss +0800"<\/span>]<\/span>
      \n timezone =<\/span>><\/span>"UTC"<\/span>
      \n #log event time timestamp…………….<\/span>
      \n target =<\/span>><\/span> "logtimestamp"<\/span>
      \n }<\/span>
      \n #log event time long string………………….<\/span>
      \n ruby {<\/span> code =<\/span>><\/span> "event.set('longtime', event.get('logtimestamp').time.to_i)"<\/span> }<\/span><\/p>\n

      mutate{<\/span>remove_field =<\/span>><\/span> [<\/span> "evtTime"<\/span>,"host"<\/span>,"ecs"<\/span>,"log"<\/span>,"hhmmss"<\/span>,"input"<\/span>,"agent"<\/span>,"atime"<\/span> ]<\/span>}<\/span>
      \n}<\/span>
      \n#other log<\/span>
      \nelse{<\/span>
      \ndrop{<\/span>}<\/span>
      \n}<\/span>
      \n}<\/span>
      \noutput{<\/span>
      \nif<\/span> [<\/span>type]<\/span> ==<\/span> "systemlogin"<\/span>{<\/span>
      \nif<\/span> [<\/span>indextime]<\/span> !<\/span>~ "index"<\/span>{<\/span>
      \nstdout{<\/span>codec =<\/span>><\/span> rubydebug}<\/span>
      \nelasticsearch{<\/span>
      \nhosts =<\/span>><\/span> "172.17.9.176"<\/span>
      \nindex =<\/span>><\/span> "sys_os_systemlogin_%{[indextime]}"<\/span>
      \nuser =<\/span>><\/span> "elastic"<\/span>
      \npassword =<\/span>><\/span> "f5OPbv6sqfstmc+"<\/span>
      \n }<\/span>
      \n}<\/span><\/p>\n

      }<\/span>
      \nelse<\/span> if<\/span> [<\/span>type]<\/span> ==<\/span> "systemloginfailed"<\/span>{<\/span>
      \n if<\/span> [<\/span>indextime]<\/span> !<\/span>~ "index"<\/span>{<\/span>
      \n stdout{<\/span>codec =<\/span>><\/span> rubydebug}<\/span>
      \n elasticsearch{<\/span>
      \n hosts =<\/span>><\/span> "172.17.9.176"<\/span>
      \n index =<\/span>><\/span> "sys_os_systemloginfailed_%{[indextime]}"<\/span>
      \n user =<\/span>><\/span> "elastic"<\/span>
      \n password =<\/span>><\/span> "xxxxxxx+"<\/span>
      \n }<\/span>
      \n }<\/span><\/p>\n

      }<\/span>
      \n}<\/span><\/p>\n

      \u6210\u529f\u65e5\u5fd7\u89e3\u6790<\/p>\n

      \u65e5\u5fd7\u683c\u5f0f<\/p>\n

      2024<\/span>-12-03T18:45:09+08:00 192.168<\/span>.102.42 node03 [<\/span>sshd]<\/span> info: Accepted password for<\/span> root from 192.168<\/span>.96.19 port 14347<\/span> ssh2<\/p>\n

      GROK\u8bed\u6cd5<\/p>\n

      %{<\/span>TIMESTAMP_ISO8601:atime}<\/span> %{<\/span>IP:deshost}<\/span> %{<\/span>HOSTNAME<\/span>:name}<\/span> \\\\<\/span>[<\/span>%{<\/span>WORD:type}<\/span>\\\\<\/span>]<\/span> %{<\/span>DATA:loglevel}<\/span>: Accepted password for<\/span> %{<\/span>WORD:loginuser}<\/span> from %{<\/span>IP:srchost}<\/span> port %{<\/span>NUMBER:port}<\/span> %{<\/span>WORD:loginmode}<\/span><\/p>\n

      \u65e5\u5fd7\u683c\u5f0f<\/p>\n

      {<\/span>
      \n "loginuser"<\/span>:<\/span> "root"<\/span>,
      \n "atime"<\/span>:<\/span> "2024-12-03T18:45:09+08:00"<\/span>,
      \n "type"<\/span>:<\/span> "sshd"<\/span>,
      \n "deshost"<\/span>:<\/span> "192.168.102.42"<\/span>,
      \n "srchost"<\/span>:<\/span> "192.168.96.19"<\/span>,
      \n "port"<\/span>:<\/span> "14347"<\/span>,
      \n "loglevel"<\/span>:<\/span> "info"<\/span>,
      \n "name"<\/span>:<\/span> "node03"<\/span>,
      \n "loginmode"<\/span>:<\/span> "ssh2"<\/span>
      \n}<\/span><\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

      \u5931\u8d25\u65e5\u5fd7\u683c\u5f0f<\/p>\n

      \u65e5\u5fd7\u683c\u5f0f<\/p>\n

      2024<\/span>-12-03T19:01:57+08:00 192.168<\/span>.102.42 node03 [<\/span>sshd]<\/span> info: Failed password for<\/span> invalid user 123<\/span> from 192.168<\/span>.96.19 port 12103<\/span> ssh2<\/p>\n

      GROK\u8bed\u6cd5<\/p>\n

      ^(<\/span>?<<\/span>atime><\/span>\\\\<\/span>d+-\\\\<\/span>d+-\\\\<\/span>d+)<\/span>(<\/span>?:[<\/span>^\\\\<\/span>d]<\/span>+)<\/span>(<\/span>?<<\/span>hhmmss><\/span>\\\\<\/span>d+:\\\\<\/span>d+:\\\\<\/span>d+)<\/span>(<\/span>?:[<\/span>^\\\\<\/span>d]<\/span>+\\\\<\/span>d+:\\\\<\/span>d+)<\/span>(<\/span>?:\\\\<\/span>s+)<\/span>(<\/span>?<<\/span>deshost><\/span>\\\\<\/span>d+\\\\<\/span>.\\\\<\/span>d+\\\\<\/span>.\\\\<\/span>d+\\\\<\/span>.\\\\<\/span>d+)<\/span>(<\/span>?:[<\/span>\\\\<\/span>S\\\\<\/span>s]<\/span>*Failed\\\\<\/span>spassword\\\\<\/span>sfor[<\/span>\\\\<\/span>sinvalid\\\\<\/span>suser]<\/span>*\\\\<\/span>s)<\/span>(<\/span>?<<\/span>loginuser><\/span>[<\/span>^ ]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>sfrom\\\\<\/span>s)<\/span>(<\/span>?<<\/span>srchost><\/span>[<\/span>\\\\<\/span>d.]<\/span>+)<\/span>(<\/span>?:\\\\<\/span>s\\\\<\/span>w+\\\\<\/span>s\\\\<\/span>d+\\\\<\/span>s)<\/span>(<\/span>?<<\/span>loginmode><\/span>\\\\<\/span>w*)<\/span><\/p>\n

      \u65e5\u5fd7\u8f93\u51fa<\/p>\n

      {<\/span>
      \n "loginuser"<\/span>:<\/span> "123"<\/span>,
      \n "atime"<\/span>:<\/span> "2024-12-03"<\/span>,
      \n "hhmmss"<\/span>:<\/span> "19:01:57"<\/span>,
      \n "deshost"<\/span>:<\/span> "192.168.102.42"<\/span>,
      \n "srchost"<\/span>:<\/span> "192.168.96.19"<\/span>,
      \n "loginmode"<\/span>:<\/span> "ssh2"<\/span>
      \n}<\/span><\/p>\n

      \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n","protected":false},"excerpt":{"rendered":"

      \u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.4k\u6b21\uff0c\u70b9\u8d5e16\u6b21\uff0c\u6536\u85cf30\u6b21\u3002\u968f\u7740\u4f01\u4e1aIT\u57fa\u7840\u8bbe\u65bd\u7684\u4e0d\u65ad\u6269\u5927\uff0cLinux\u670d\u52a1\u5668\u7684\u6570\u91cf\u4e5f\u65e5\u76ca\u589e\u591a\uff0c\u4f20\u7edf\u7684\u5355\u673a\u65e5\u5fd7\u7ba1\u7406\u65b9\u5f0f\u5df2\u65e0\u6cd5\u6ee1\u8db3\u5bf9\u65e5\u5fd7\u6570\u636e\u96c6\u4e2d\u7ba1\u7406\u3001\u5ba1\u8ba1\u548c\u5206\u6790\u7684\u9700\u6c42\u3002\u5c24\u5176\u662f\u5728\u5927\u578b\u96c6\u7fa4\u73af\u5883\u4e2d\uff0c\u5982\u4f55\u9ad8\u6548\u5730\u6536\u96c6\u3001\u5b58\u50a8\u548c\u5206\u6790\u65e5\u5fd7\u6210\u4e3a\u4e86\u4e00\u9879\u91cd\u8981\u7684\u6280\u672f\u6311\u6218\u3002_\u65e5\u5fd7\u5ba1\u8ba1\u670d\u52a1\u5668\u642d\u5efa<\/p>\n","protected":false},"author":2,"featured_media":26731,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[58,43,44,2139],"topic":[],"class_list":["post-26740","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-linux","tag-43","tag-44","tag-2139"],"yoast_head":"\n\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/26740.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.4k\u6b21\uff0c\u70b9\u8d5e16\u6b21\uff0c\u6536\u85cf30\u6b21\u3002\u968f\u7740\u4f01\u4e1aIT\u57fa\u7840\u8bbe\u65bd\u7684\u4e0d\u65ad\u6269\u5927\uff0cLinux\u670d\u52a1\u5668\u7684\u6570\u91cf\u4e5f\u65e5\u76ca\u589e\u591a\uff0c\u4f20\u7edf\u7684\u5355\u673a\u65e5\u5fd7\u7ba1\u7406\u65b9\u5f0f\u5df2\u65e0\u6cd5\u6ee1\u8db3\u5bf9\u65e5\u5fd7\u6570\u636e\u96c6\u4e2d\u7ba1\u7406\u3001\u5ba1\u8ba1\u548c\u5206\u6790\u7684\u9700\u6c42\u3002\u5c24\u5176\u662f\u5728\u5927\u578b\u96c6\u7fa4\u73af\u5883\u4e2d\uff0c\u5982\u4f55\u9ad8\u6548\u5730\u6536\u96c6\u3001\u5b58\u50a8\u548c\u5206\u6790\u65e5\u5fd7\u6210\u4e3a\u4e86\u4e00\u9879\u91cd\u8981\u7684\u6280\u672f\u6311\u6218\u3002_\u65e5\u5fd7\u5ba1\u8ba1\u670d\u52a1\u5668\u642d\u5efa\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/26740.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-19T08:56:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2025\/04\/20250419085627-6803653b7ddb8.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/26740.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/26740.html\",\"name\":\"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2025-04-19T08:56:33+00:00\",\"dateModified\":\"2025-04-19T08:56:33+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/26740.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/26740.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/26740.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/26740.html","og_locale":"zh_CN","og_type":"article","og_title":"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.4k\u6b21\uff0c\u70b9\u8d5e16\u6b21\uff0c\u6536\u85cf30\u6b21\u3002\u968f\u7740\u4f01\u4e1aIT\u57fa\u7840\u8bbe\u65bd\u7684\u4e0d\u65ad\u6269\u5927\uff0cLinux\u670d\u52a1\u5668\u7684\u6570\u91cf\u4e5f\u65e5\u76ca\u589e\u591a\uff0c\u4f20\u7edf\u7684\u5355\u673a\u65e5\u5fd7\u7ba1\u7406\u65b9\u5f0f\u5df2\u65e0\u6cd5\u6ee1\u8db3\u5bf9\u65e5\u5fd7\u6570\u636e\u96c6\u4e2d\u7ba1\u7406\u3001\u5ba1\u8ba1\u548c\u5206\u6790\u7684\u9700\u6c42\u3002\u5c24\u5176\u662f\u5728\u5927\u578b\u96c6\u7fa4\u73af\u5883\u4e2d\uff0c\u5982\u4f55\u9ad8\u6548\u5730\u6536\u96c6\u3001\u5b58\u50a8\u548c\u5206\u6790\u65e5\u5fd7\u6210\u4e3a\u4e86\u4e00\u9879\u91cd\u8981\u7684\u6280\u672f\u6311\u6218\u3002_\u65e5\u5fd7\u5ba1\u8ba1\u670d\u52a1\u5668\u642d\u5efa","og_url":"https:\/\/www.wsisp.com\/helps\/26740.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2025-04-19T08:56:33+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2025\/04\/20250419085627-6803653b7ddb8.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"8 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/26740.html","url":"https:\/\/www.wsisp.com\/helps\/26740.html","name":"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2025-04-19T08:56:33+00:00","dateModified":"2025-04-19T08:56:33+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/26740.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/26740.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/26740.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u96c6\u4e2d\u7ba1\u7406\u4e0e\u5b9e\u65f6\u5ba1\u8ba1\uff1a\u6784\u5efaLinux\u96c6\u7fa4\uff081300\u53f0\u670d\u52a1\u5668\uff09\u65e5\u5fd7\u5e73\u53f0\u7684\u6700\u4f73\u5b9e\u8df5"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/26740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=26740"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/26740\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/26731"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=26740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=26740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=26740"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=26740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}