Graylog2 v0.92 正式发布,支持 SSL/TLS

jopen 10年前

Graylog2 是一个用来将系统日志syslog保存到MongoDB中的工具。 包括一个用Java编写的服务器,可接收来自TCP和UDP的syslog信息,Web接口使用Ruby编写,基于 Rails 框架,可用来查看日志信息。

主要特性

  • 通过 TCP/UDP 接收syslog信息

  • 基于 MongoDB 的快速后端存储

  • GELF (Graylog Extended Log Format)

  • 黑名单

  • 过滤器

  • 统计

Graylog2 v0.92 正式发布,此版本包括大量新特性,bug 修复和改进。

内容封装

内容封装绑定了 Graylog2 输入,提取器,流,仪表板和输出配置,可以提供完整的数据源支持。一些内容封装是默认的,可以在这个网站下载,也可以使用 Graylog2 Web 页面导入。 content pack for nginx

Graylog2 v0.92 正式发布,支持 SSL/TLS

新来源页面

新来源页面提供动态分析和不同源代码的导航,可以发送消息到你的 Graylog2 设置。

Graylog2 v0.92 正式发布,支持 SSL/TLS

基于时间的保留清理

你可以选择启用基于时间的保留清理,旧的基于消息计数的策略还是默认的策略,当然,你也可以修改成基于时间的清理:

#elasticsearch_max_docs_per_index = 20000000  #elasticsearch_max_size_per_index = 1073741824    # Permitted suffixes are: d for day, h for hour, m for minute, s for second.  elasticsearch_max_time_per_index = 1d    elasticsearch_max_number_of_indices = 20

Graylog2 REST API 支持 SSL/TLS

Graylog2 REST API 现在开箱支持 SSL/TLS,提升了系统的安全性。之前的 HTTPS 代理需要部署在 REST API 之前:

  • rest_enable_tls (default: false): Option to activate SSL/TLS for the Graylog2 REST API

  • rest_tls_cert_file (default: empty): Path to the certificate file. If SSL/TLS is activated but this setting is empty, a temporary self-signed certificate will automatically be created.

  • rest_tls_key_file (default: empty): Path to the private key file. If SSL/TLS is activated but this setting is empty, a temporary private key will automatically be created.

  • rest_tls_key_password (default: empty): Optional passphrase to decrypt the private key.

其他值得关注的特性

  • [SERVER] IMPORTANT SECURITY FIX: It was possible to perform LDAP logins with crafted wildcards. (A big thank you to Jose Tozo who discovered this issue and disclosed it very responsibly.)

  • [SERVER] Generate a system notification if garbage collection takes longer than a configurable threshold.

  • [SERVER] Added several JVM-related metrics.

  • [SERVER] Added support for Elasticsearch 1.4.x which brings a lot of stability and resilience features to Elasticsearch clusters.

  • [SERVER] Made version check of Elasticsearch version optional. Disabling this check is not recommended.

  • [SERVER] Added an option to disable optimizing Elasticsearch indices on index cycling.

  • [SERVER] Added an option to disable time-range calculation for indices on index cycling.

  • [SERVER] Lots of other performance enhancements for large setups (i.e. involving several Radio nodes and multiple Graylog2 Servers).

  • [SERVER] Support for Syslog Octet Counting, as used by syslog-ng for syslog via TCP (#743)

  • [SERVER] Improved support for structured syslog messages (#744)

  • [SERVER] Bug fixes regarding IPv6 literals in mongodb_replica_set and elasticsearch_discovery_zen_ping_unicast_hosts

  • [WEB] Added additional details to system notification about Elasticsearch max. open file descriptors.

  • [WEB] Fixed several bugs and inconsistencies regarding time zones.

  • [WEB] Improved graphs and diagrams

  • [WEB] Allow to update dashboards when browser window is not on focus (#738)

  • [WEB] Bug fixes regarding timezone handling

  • …and of course numerous internal bug fixes

下载

http://www.graylog2.org/download

Elasticsearch 升级指南:

更多内容请看发行说明

 

Graylog2 v0.92 正式发布,支持 SSL/TLS

来自:http://www.oschina.net/news/57552/graylog2-0-92