From 06430a9edc54e3e127141f41ab94183838eeb744 Mon Sep 17 00:00:00 2001 From: Neil Lathwood Date: Mon, 10 Aug 2015 13:36:55 -0700 Subject: [PATCH 1/9] Added graylog support --- html/ajax_dash.php | 2 + html/includes/common/graylog.inc.php | 125 +++++++++++++++++++++++++++ html/includes/print-menubar.php | 14 ++- html/includes/table/graylog.inc.php | 64 ++++++++++++++ html/pages/device/logs.inc.php | 12 +++ html/pages/graylog.inc.php | 4 + sql-schema/062.sql | 1 + 7 files changed, 219 insertions(+), 3 deletions(-) create mode 100644 html/includes/common/graylog.inc.php create mode 100644 html/includes/table/graylog.inc.php create mode 100644 html/pages/graylog.inc.php create mode 100644 sql-schema/062.sql diff --git a/html/ajax_dash.php b/html/ajax_dash.php index e25994282..3b4c56e46 100644 --- a/html/ajax_dash.php +++ b/html/ajax_dash.php @@ -33,6 +33,8 @@ if ($type == 'placeholder') { } elseif (is_file('includes/common/'.$type.'.inc.php')) { + $results_limit = 10; + $no_form = true; include 'includes/common/'.$type.'.inc.php'; $output = implode('', $common_output); $status = 'ok'; diff --git a/html/includes/common/graylog.inc.php b/html/includes/common/graylog.inc.php new file mode 100644 index 000000000..0d24e8406 --- /dev/null +++ b/html/includes/common/graylog.inc.php @@ -0,0 +1,125 @@ + + * + * This program is free software: you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation, either version 3 of the License, or (at your + * option) any later version. Please see LICENSE.txt at the top level of + * the source code distribution for details. + */ + +if (empty($results_limit)) { + $results_limit = 25; +} +$tmp_output = '

Graylog

+ +
+ + + + + + + + + + +
TimestampSourceMessageFacilityLevel
+
+ + + +'; + +$common_output[] = $tmp_output; diff --git a/html/includes/print-menubar.php b/html/includes/print-menubar.php index 54b51213f..14aa08ca8 100644 --- a/html/includes/print-menubar.php +++ b/html/includes/print-menubar.php @@ -77,9 +77,17 @@ if ($_SESSION['userlevel'] >= '10') {
  • Eventlog
    • - Syslog'); -} ?> + Syslog'; +} + +if (isset($config['graylog']['server']) && isset($config['graylog']['port'])) { + echo '
  • Graylog
    • '; +} + +?>
  • Inventory
    • diff --git a/html/includes/table/graylog.inc.php b/html/includes/table/graylog.inc.php new file mode 100644 index 000000000..88165e9fe --- /dev/null +++ b/html/includes/table/graylog.inc.php @@ -0,0 +1,64 @@ + + * + * This program is free software: you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation, either version 3 of the License, or (at your + * option) any later version. Please see LICENSE.txt at the top level of + * the source code distribution for details. + */ + +$filter_hostname = mres($_POST['hostname']); +$filter_range = mres($_POST['range']); + +if (isset($searchPhrase) && !empty($searchPhrase)) { + $query = 'message:"'.$searchPhrase.'"'; +} +else { + $query = '*'; +} + +if (isset($current)) { + $offset = ($current * $rowCount) - ($rowCount); + $limit = $rowCount; +} + +if ($rowCount != -1) { + $extra_query = "&limit=$limit&offset=$offset"; +} + +if (!empty($filter_hostname)) { + if (!empty($query)) { + $query .= ' && '; + } + $query .= 'source:"'.$filter_hostname.'"'; +} + +$graylog_url = $config['graylog']['server'] . ':' . $config['graylog']['port'] . '/search/universal/relative?query=' . urlencode($query) . '&range='. $filter_range . $extra_query; + +$context = stream_context_create(array( + 'http' => array( + 'header' => "Authorization: Basic " . base64_encode($config['graylog']['username'].':'.$config['graylog']['password']) + ) +)); + +$messages = json_decode(file_get_contents($graylog_url, false, $context),true); + +foreach ($messages['messages'] as $message) { + $response[] = array( + 'timestamp' => $message['message']['timestamp'], + 'source' => $message['message']['source'], + 'message' => $message['message']['message'], + 'facility' => $message['message']['facility'], + 'level' => $message['message']['level'], + ); +} + +$total = $messages['total_results']; + +$output = array('current'=>$current,'rowCount'=>$rowCount,'rows'=>$response,'total'=>$total); +echo _json_encode($output); diff --git a/html/pages/device/logs.inc.php b/html/pages/device/logs.inc.php index 11fd6914b..81fea25a1 100644 --- a/html/pages/device/logs.inc.php +++ b/html/pages/device/logs.inc.php @@ -30,9 +30,21 @@ if (isset($config['enable_syslog']) && $config['enable_syslog'] == 1) { } } +if (isset($config['graylog']['server']) && isset($config['graylog']['port'])) { + echo ' | '; + if ($vars['section'] == 'graylog') { + echo ''; + } + echo generate_link('Graylog', $vars, array('section' => 'graylog')); + if ($vars['section'] == 'graylog') { + echo ''; + } +} + switch ($vars['section']) { case 'syslog': case 'eventlog': + case 'graylog': include 'pages/device/logs/'.$vars['section'].'.inc.php'; break; diff --git a/html/pages/graylog.inc.php b/html/pages/graylog.inc.php new file mode 100644 index 000000000..78d59ec64 --- /dev/null +++ b/html/pages/graylog.inc.php @@ -0,0 +1,4 @@ + Date: Tue, 11 Aug 2015 09:44:35 -0700 Subject: [PATCH 2/9] Added docs on using Grallog integration --- doc/Extensions/Graylog.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 doc/Extensions/Graylog.md diff --git a/doc/Extensions/Graylog.md b/doc/Extensions/Graylog.md new file mode 100644 index 000000000..32d0ab1cd --- /dev/null +++ b/doc/Extensions/Graylog.md @@ -0,0 +1,17 @@ +# Graylog integration + +We have simple integration for Graylog, you will be able to view any logs from within LibreNMS that have been parsed by the syslog input from within +Graylog itself. This includes logs from devices which aren't in LibreNMS still, you can also see logs for a sepcific device under the logs section +for the device. + +Graylog itself isn't included within LibreNMS, you will need to install this separately either on the same infrastructure as LibreNMS or as a totally +standalone appliance. + +Config is simple, here's an example: + +```php +$config['graylog']['server'] = 'http://127.0.0.1'; +$config['graylog']['port'] = 12900; +$config['graylog']['username'] = 'admin'; +$config['graylog']['password'] = 'admin'; +``` From d7cd1ff0f618c03ed1218ebf0848168a1937b5eb Mon Sep 17 00:00:00 2001 From: laf Date: Tue, 11 Aug 2015 14:50:05 -0700 Subject: [PATCH 3/9] Added accept header to call to graylog api --- html/includes/table/graylog.inc.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/html/includes/table/graylog.inc.php b/html/includes/table/graylog.inc.php index 88165e9fe..1d21d7b18 100644 --- a/html/includes/table/graylog.inc.php +++ b/html/includes/table/graylog.inc.php @@ -42,7 +42,8 @@ $graylog_url = $config['graylog']['server'] . ':' . $config['graylog']['port'] . $context = stream_context_create(array( 'http' => array( - 'header' => "Authorization: Basic " . base64_encode($config['graylog']['username'].':'.$config['graylog']['password']) + 'header' => "Authorization: Basic " . base64_encode($config['graylog']['username'].':'.$config['graylog']['password']) . "\r\n" . + "Accept: application/json", ) )); From 85c8e1487fd19021c10018452a2fa76be1d200b4 Mon Sep 17 00:00:00 2001 From: laf Date: Sun, 16 Aug 2015 11:12:24 +0000 Subject: [PATCH 4/9] updated sql file # --- sql-schema/{062.sql => 063.sql} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename sql-schema/{062.sql => 063.sql} (100%) diff --git a/sql-schema/062.sql b/sql-schema/063.sql similarity index 100% rename from sql-schema/062.sql rename to sql-schema/063.sql From 8f5ef6d281ef8625061cf258704310c5af5d4ead Mon Sep 17 00:00:00 2001 From: laf Date: Mon, 17 Aug 2015 10:46:40 +0000 Subject: [PATCH 5/9] Updated to use ip for source as well --- html/includes/table/graylog.inc.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/html/includes/table/graylog.inc.php b/html/includes/table/graylog.inc.php index 1d21d7b18..c35e34215 100644 --- a/html/includes/table/graylog.inc.php +++ b/html/includes/table/graylog.inc.php @@ -35,7 +35,8 @@ if (!empty($filter_hostname)) { if (!empty($query)) { $query .= ' && '; } - $query .= 'source:"'.$filter_hostname.'"'; + $ip = gethostbyname($filter_hostname); + $query .= 'source:"'.$filter_hostname.'" || source:"'.$ip.'"'; } $graylog_url = $config['graylog']['server'] . ':' . $config['graylog']['port'] . '/search/universal/relative?query=' . urlencode($query) . '&range='. $filter_range . $extra_query; @@ -59,7 +60,12 @@ foreach ($messages['messages'] as $message) { ); } -$total = $messages['total_results']; +if (empty($messages['total_results'])) { + $total = 0; +} +else { + $total = $messages['total_results']; +} $output = array('current'=>$current,'rowCount'=>$rowCount,'rows'=>$response,'total'=>$total); echo _json_encode($output); From 995b02b1769df3113bbe4d0b510a668e9b3af40f Mon Sep 17 00:00:00 2001 From: laf Date: Mon, 17 Aug 2015 10:48:29 +0000 Subject: [PATCH 6/9] Added devices graylog page - had to force as .gitignore excludes this! --- html/pages/device/logs/graylog.inc.php | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 html/pages/device/logs/graylog.inc.php diff --git a/html/pages/device/logs/graylog.inc.php b/html/pages/device/logs/graylog.inc.php new file mode 100644 index 000000000..19e0d6115 --- /dev/null +++ b/html/pages/device/logs/graylog.inc.php @@ -0,0 +1,5 @@ + Date: Mon, 17 Aug 2015 10:55:44 +0000 Subject: [PATCH 7/9] Make url from source --- html/includes/table/graylog.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/includes/table/graylog.inc.php b/html/includes/table/graylog.inc.php index c35e34215..8a376fd98 100644 --- a/html/includes/table/graylog.inc.php +++ b/html/includes/table/graylog.inc.php @@ -53,7 +53,7 @@ $messages = json_decode(file_get_contents($graylog_url, false, $context),true); foreach ($messages['messages'] as $message) { $response[] = array( 'timestamp' => $message['message']['timestamp'], - 'source' => $message['message']['source'], + 'source' => generate_url(array('page'=>'device', 'device'=>$message['message']['source'])), 'message' => $message['message']['message'], 'facility' => $message['message']['facility'], 'level' => $message['message']['level'], From d23e93f44a4adc54d0ac34e67874a9e3818c3229 Mon Sep 17 00:00:00 2001 From: laf Date: Tue, 18 Aug 2015 16:46:33 +0000 Subject: [PATCH 8/9] Made source clickable --- html/includes/table/graylog.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/includes/table/graylog.inc.php b/html/includes/table/graylog.inc.php index 8a376fd98..6ea13c630 100644 --- a/html/includes/table/graylog.inc.php +++ b/html/includes/table/graylog.inc.php @@ -53,7 +53,7 @@ $messages = json_decode(file_get_contents($graylog_url, false, $context),true); foreach ($messages['messages'] as $message) { $response[] = array( 'timestamp' => $message['message']['timestamp'], - 'source' => generate_url(array('page'=>'device', 'device'=>$message['message']['source'])), + 'source' => ';'.$message['message']['source'].'', 'message' => $message['message']['message'], 'facility' => $message['message']['facility'], 'level' => $message['message']['level'], From 92de079199e6a3f82c5d5ab93dadc1bfa8fba700 Mon Sep 17 00:00:00 2001 From: laf Date: Tue, 18 Aug 2015 16:52:25 +0000 Subject: [PATCH 9/9] Removed ; --- html/includes/table/graylog.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/includes/table/graylog.inc.php b/html/includes/table/graylog.inc.php index 6ea13c630..b56b1402b 100644 --- a/html/includes/table/graylog.inc.php +++ b/html/includes/table/graylog.inc.php @@ -53,7 +53,7 @@ $messages = json_decode(file_get_contents($graylog_url, false, $context),true); foreach ($messages['messages'] as $message) { $response[] = array( 'timestamp' => $message['message']['timestamp'], - 'source' => ';'.$message['message']['source'].'', + 'source' => ''.$message['message']['source'].'', 'message' => $message['message']['message'], 'facility' => $message['message']['facility'], 'level' => $message['message']['level'],