Skip to content

Commit b6fbb34

Browse files
author
Ruslan Gainutdinov
committed
Improved documentation
1 parent 0a028d6 commit b6fbb34

File tree

1 file changed

+56
-50
lines changed

1 file changed

+56
-50
lines changed

‎README.md‎

Lines changed: 56 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,23 @@ This plugin is also published on graylog marketplace.
1313
https://marketplace.graylog.org/addons/8eb67dc0-b855-455c-a37f-0fa8ae522854
1414

1515
## How to build
16+
1617
This project is using Maven and requires Java 8 or higher.
1718

1819
You can build a plugin (JAR) with `mvn package`.
1920

2021
## How to use
2122

22-
* Download graylog2-output-syslog-<VERSION>.jar from releases and put inside plugins folder
23-
* Restart Graylog server
24-
* Create a new output globally or attached to a stream.
23+
- Download `graylog2-output-syslog-VERSION.jar` from releases and put inside plugins folder
24+
- Restart Graylog server
25+
- Create a new output globally or attached to a stream.
2526

2627
## Configuration
2728

28-
* *Message dispatch protocol*: Select tcp or udp
29-
* *Syslog host*: Hostname of the remote syslog serevr
30-
* *Syslog port*: Syslog receiver port on remote host, usually 514
31-
* *Format*: Specify one of plain, structured, full, cef or custom:FQCN (see below for explanation on values)
29+
- _Message dispatch protocol_: Select tcp or udp
30+
- _Syslog host_: Hostname of the remote syslog serevr
31+
- _Syslog port_: Syslog receiver port on remote host, usually 514
32+
- _Format_: Specify one of plain, structured, full, cef or custom:FQCN (see below for explanation on values)
3233

3334
![Screenshot of add new output dialog](graylog2-output-syslog-2.1.3-parameters.png)
3435

@@ -38,17 +39,19 @@ You can build a plugin (JAR) with `mvn package`.
3839

3940
Standard plain syslog format. Minimal information.
4041
Example:
41-
````
42+
43+
```
4244
<14>Mar 31 19:19:02 nginx runit-service - GET /test1/x HTTP/1.1
43-
````
45+
```
4446

4547
### structured
4648

4749
Based on rfc5424. Sends all fields + log message.
4850
Example:
49-
````
51+
52+
```
5053
<14>1 2016-03-31T19:31:46.358Z graylog unknown - nginx [all@0 request_verb="GET" remote_addr="192.168.1.37" response_status="404" from_nginx="true" level="6" connection_requests="1" http_version="1.1" response_bytes="1906" source="nginx" message="GET /test1/2 HTTP/1.1" gl2_source_input="566c96abe4b094dfbc2661a8" version="1.1" nginx_access="true" http_user_agent="Wget/1.15 (linux-gnu)" remote_user="-" connection_id="1755" http_referer="-" request_path="/test1/2" gl2_source_node="bebd092c-85d7-49a3-8188-f7af734747fb" _id="34cb0f40-f777-11e5-b30c-0800276c97db" millis="0.002" facility="runit-service" timestamp="2016-03-31T19:31:46.000Z"] GET /test1/2 HTTP/1.1
51-
````
54+
```
5255

5356
### cef
5457

@@ -58,87 +61,90 @@ Common event format aka HP ArcSight format. For this format to work you must set
5861

5962
A variation of structured format except full message is added.
6063
Example:
61-
````
64+
65+
```
6266
<14>1 2016-03-31T19:19:02.524Z graylog unknown - nginx [all@0 request_verb="GET" remote_addr="192.168.1.37" response_status="404" from_nginx="true" level="6" connection_requests="1" http_version="1.1" response_bytes="1906" source="nginx" message="GET /test1/x HTTP/1.1" gl2_source_input="566c96abe4b094dfbc2661a8" version="1.1" nginx_access="true" http_user_agent="Wget/1.15 (linux-gnu)" remote_user="-" connection_id="970" http_referer="-" request_path="/test1/x" gl2_source_node="bebd092c-85d7-49a3-8188-f7af734747fb" _id="6d833da0-f775-11e5-b30c-0800276c97db" millis="0.002" facility="runit-service" timestamp="2016-03-31T19:19:02.000Z"] source: nginx | message: GET /test1/x HTTP/1.1 { request_verb: GET | remote_addr: 192.168.1.37 | response_status: 404 | from_nginx: true | level: 6 | connection_requests: 1 | http_version: 1.1 | response_bytes: 1906 | gl2_source_input: 566c96abe4b094dfbc2661a8 | version: 1.1 | nginx_access: true | http_user_agent: Wget/1.15 (linux-gnu) | remote_user: - | connection_id: 970 | http_referer: - | request_path: /test1/x | gl2_source_node: bebd092c-85d7-49a3-8188-f7af734747fb | _id: 6d833da0-f775-11e5-b30c-0800276c97db | millis: 0.002 | facility: runit-service | timestamp: 2016-03-31T19:19:02.000Z }
63-
````
67+
```
6468

6569
### trasparent
6670

6771
A variation of plain sender without facility and source (they are in original message).
6872
Example:
69-
````
73+
74+
```
7075
<14>Feb 11 17:32:06 graylog01 sshd[26524]: Failed password for admin7 from 10.128.230.28 port 58363 ssh2
71-
````
76+
```
7277

7378
### snare
7479

7580
Re-build a snare log format of windows event in stream.
7681
Example:
77-
````
82+
83+
```
7884
<14>Feb 11 17:32:26 graylog01 MSWinEventLog 1 Security 65493 Mon Feb 11 17:32:26 2019 4726 Microsoft-Windows-Security-Auditing N/A N/A AUDIT_SUCCESS WIN-8F8OSAB5AMC.testwin.lan User Account Management A user account was deleted. Subject: Security ID: S-1-5-21-2081084977-3747244460-254679223-500 Account Name: Administrator Account Domain: TESTWIN Logon ID: 0x5F1B5 Target Account: Security ID: S-1-5-21-2081084977-3747244460-254679223-1126 Account Name: admintest Account Domain: TESTWIN Additional Information: Privileges - 65493
79-
````
85+
```
8086

8187
### custom:FQCN
8288

8389
Specify your implementation of com.wizecore.graylog2.plugin.MessageSender interface.
8490

8591
## CEF format handling
8692

87-
Here is the algorithm for CEF message delivery used in this plugin. If you don`t understand that this, consult [Common Event Format Guide](https://community.saas.hpe.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Guide/ta-p/1589306)
93+
There are format for CEF message delivery used in this plugin. For more information, consult ArcSight [Common Event Format Guide](https://community.saas.hpe.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Guide/ta-p/1589306)
8894

8995
### Header
9096

91-
Plugin outputs CEF Header with following fields: ``CEF:0|Graylog|graylog-output-syslog:cefsender|2.3.1|``
97+
Plugin outputs CEF Header with following fields: `CEF:0|Graylog|graylog-output-syslog:cefsender|2.3.1|`
9298

9399
### Device Event Class ID field
94100

95-
Currently it is hardcoded as ``log:1``
101+
Currently it is hardcoded as `log:1`
96102

97103
### Name field
98104

99-
- If message contains ``act`` field then it is used
100-
- If message contains ``short_message`` field then it is used
101-
- else Graylog messageId is used for Name field
102-
105+
- If message contains `act` field then it is used
106+
- If message contains `short_message` field then it is used
107+
- else Graylog messageId is used for Name field
108+
103109
New lines are stripped from this field. Proper escaping applied.
104-
110+
105111
### Severity field
106112

107113
Mapping performed between syslog level and CEF log level.
108114

109-
Syslog | CEF
110-
--- | ---
111-
DEBUG | 1
112-
NOTICE | 2
113-
INFO | 3
114-
WARN | 6
115-
ERROR | 7
116-
CRITICAL | 8
117-
ALERT | 9
118-
EMERGENCY | 10
115+
| Syslog | CEF |
116+
| --------- | --- |
117+
| DEBUG | 1 |
118+
| NOTICE | 2 |
119+
| INFO | 3 |
120+
| WARN | 6 |
121+
| ERROR | 7 |
122+
| CRITICAL | 8 |
123+
| ALERT | 9 |
124+
| EMERGENCY | 10 |
119125

120126
### Extension fields
121127

122-
Every existing message fields is written to Extension except ``message``, ``full_message`` and ``short_message``
128+
Every existing message fields is written to Extension except `message`, `full_message` and `short_message`
123129

124130
### Automatically generated extension fields
125131

126132
If existing fields does not contain such keys, following fields will be added to extension:
127133

128-
CEF Key Name | Source
129-
--- | ---
130-
start | Message timestamp, unix time in milliseconds
131-
msg | Message text (``message``)
132-
externalId | Message ID (assigned by Graylog)
134+
| CEF Key Name | Source |
135+
| ------------ | -------------------------------------------- |
136+
| start | Message timestamp, unix time in milliseconds |
137+
| msg | Message text (`message`) |
138+
| externalId | Message ID (assigned by Graylog) |
133139

134140
## Links
135141

136-
* https://tools.ietf.org/html/rfc5424
137-
* https://github.com/Graylog2
138-
* http://blog.rootshell.be/2011/05/11/ossec-speaks-arcsight/
139-
* https://groups.google.com/forum/#!topic/ossec-list/3guXmHJYHtY
140-
* http://habrahabr.ru/post/151631/
141-
* http://www.syslog4j.org/
142-
* https://www.graylog.org/resources/gelf-2/
143-
* http://docs.graylog.org/en/1.0/pages/plugins.html
144-
* https://community.saas.hpe.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Guide/ta-p/1589306
142+
- https://tools.ietf.org/html/rfc5424
143+
- https://github.com/Graylog2
144+
- http://blog.rootshell.be/2011/05/11/ossec-speaks-arcsight/
145+
- https://groups.google.com/forum/#!topic/ossec-list/3guXmHJYHtY
146+
- http://habrahabr.ru/post/151631/
147+
- http://www.syslog4j.org/
148+
- https://www.graylog.org/resources/gelf-2/
149+
- http://docs.graylog.org/en/1.0/pages/plugins.html
150+
- https://community.saas.hpe.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Guide/ta-p/1589306

0 commit comments

Comments
 (0)