iac
/
syslog-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

turn on geoip2

This commit is contained in:
Kameron Kenny 2024-06-18 13:06:16 -04:00
parent f4ce9b5100
commit 2d2d0c84f1
No known key found for this signature in database
GPG Key ID: E5006629839D2276
3 changed files with 40 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Dockerfile
View File

@ -1,7 +1,7 @@
FROM debian:latest FROM debian:latest
MAINTAINER Kameron Kenny <kkenny379@gmail.com> MAINTAINER Kameron Kenny <kkenny379@gmail.com>
LABEL version="20240618.1.6" LABEL version="20240618.1.7"
LABEL description="Debian Based syslog-ng" LABEL description="Debian Based syslog-ng"
RUN apt-get update RUN apt-get update

76
config/syslog-ng.conf
View File

@ -24,36 +24,36 @@ filter f_unifi_wlan { message("wlan:"); };
parser p_kv { kv-parser(prefix("kv.")); }; parser p_kv { kv-parser(prefix("kv.")); };
parser p_suricata_json { json-parser(prefix("suricata.")); }; parser p_suricata_json { json-parser(prefix("suricata.")); };
#parser p_fw_src_ip_geoip2_city { parser p_fw_src_ip_geoip2_city {
# geoip2( geoip2(
# "${kv.SRC}", "${kv.SRC}",
# prefix( "geoip2." ) prefix( "geoip2.source." )
# database( "/config/GeoIP/GeoLite2-City.mmdb" ) database( "/config/GeoIP/GeoLite2-City.mmdb" )
# ); );
#}; };
#parser p_fw_dst_ip_geoip2_city { parser p_fw_dst_ip_geoip2_city {
# geoip2( geoip2(
# "${kv.DST}", "${kv.DST}",
# prefix( "geoip2." ) prefix( "geoip2.destination." )
# database( "/config/GeoIP/GeoLite2-City.mmdb" ) database( "/config/GeoIP/GeoLite2-City.mmdb" )
# ); );
#}; };
#parser p_suricata_dest_ip_geoip2_city { parser p_suricata_dest_ip_geoip2_city {
# geoip2( geoip2(
# "${suricata.dest_ip}", "${suricata.dest_ip}",
# prefix( "geoip2." ) prefix( "geoip2.destination." )
# database( "/config/GeoIP/GeoLite2-City.mmdb" ) database( "/config/GeoIP/GeoLite2-City.mmdb" )
# ); );
#}; };
#parser p_suricata_src_ip_geoip2_city { parser p_suricata_src_ip_geoip2_city {
# geoip2( geoip2(
# "${suricata.src_ip}", "${suricata.src_ip}",
# prefix( "geoip2." ) prefix( "geoip2.source." )
# database( "/config/GeoIP/GeoLite2-City.mmdb" ) database( "/config/GeoIP/GeoLite2-City.mmdb" )
# ); );
#}; };
destination d_local { destination d_local {
file("/var/log/messages"); file("/var/log/messages");
@ -206,8 +206,8 @@ log {
source(s_network_udp); source(s_network_udp);
filter(f_unifi_suricata); filter(f_unifi_suricata);
parser(p_suricata_json); parser(p_suricata_json);
# parser(p_suricata_src_ip_geoip2_city); parser(p_suricata_src_ip_geoip2_city);
# parser(p_suricata_dest_ip_geoip2_city); parser(p_suricata_dest_ip_geoip2_city);
destination(d_unifi_suricata); destination(d_unifi_suricata);
flags(final); flags(final);
}; };
@ -223,8 +223,8 @@ log {
source(s_network_udp); source(s_network_udp);
filter(f_unifi_fw_lan); filter(f_unifi_fw_lan);
parser(p_kv); parser(p_kv);
# parser(p_fw_src_ip_geoip2_city); parser(p_fw_src_ip_geoip2_city);
# parser(p_fw_dst_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city);
destination(d_unifi_firewall); destination(d_unifi_firewall);
flags(final); flags(final);
}; };
@ -233,8 +233,8 @@ log {
source(s_network_udp); source(s_network_udp);
filter(f_unifi_fw_wan); filter(f_unifi_fw_wan);
parser(p_kv); parser(p_kv);
# parser(p_fw_src_ip_geoip2_city); parser(p_fw_src_ip_geoip2_city);
# parser(p_fw_dst_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city);
destination(d_unifi_firewall); destination(d_unifi_firewall);
flags(final); flags(final);
}; };
@ -243,8 +243,8 @@ log {
source(s_network_udp); source(s_network_udp);
filter(f_unifi_fw_dnat); filter(f_unifi_fw_dnat);
parser(p_kv); parser(p_kv);
# parser(p_fw_src_ip_geoip2_city); parser(p_fw_src_ip_geoip2_city);
# parser(p_fw_dst_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city);
destination(d_unifi_firewall); destination(d_unifi_firewall);
flags(final); flags(final);
}; };
@ -253,8 +253,8 @@ log {
source(s_network_udp); source(s_network_udp);
filter(f_unifi_fw_guest); filter(f_unifi_fw_guest);
parser(p_kv); parser(p_kv);
# parser(p_fw_src_ip_geoip2_city); parser(p_fw_src_ip_geoip2_city);
# parser(p_fw_dst_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city);
destination(d_unifi_firewall); destination(d_unifi_firewall);
flags(final); flags(final);
}; };

2
docker-compose.yml
View File

@ -10,7 +10,7 @@ services:
syslog-ng: syslog-ng:
build: build:
dockerfile: Dockerfile dockerfile: Dockerfile
image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240618.1.6 image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240618.1.7
container_name: syslog-ng container_name: syslog-ng
# environment: # environment:
#- PUID=0 #- PUID=0