Closed oc-oc closed 5 years ago
server端打印的日志如下:
ROLLBACK
BEGIN (implicit)
INSERT INTO OpencanaryLog
(dst_host, dst_port, honeycred, local_time, hostname, password, path, skin, useragent, username, session, localversion, remoteversion, df, idid, inin, lenlen, mac, outout, prec, proto, res, syn, tos, ttl, urgp, window
, logtype, node_id, src_host, src_port, white, repo, ntp_cmd, args, cmd, banner_id, data, function, vnc_client_response, vnc_password, vnc_server_challenge, inputs, domain, headers_call_id, headers_content_length, headers_cseq, headers_from, headers_to, headers_via, community_string, requests, urg, psh, fin, appname, cltintname, database
, language, servername, domainname) VALUES (%(dst_host)s, %(dst_port)s, %(honeycred)s, %(local_time)s, %(hostname)s, %(password)s, %(path)s, %(skin)s, %(useragent)s, %(username)s, %(session)s, %(localversion)s, %(remoteversion)s, %(df)s, %(idid)s, %(inin)s, %(lenlen)s, %(mac)s, %(outout)s, %(prec)s, %(proto)s, %(res)s, %(syn)s, %(tos)s, %(ttl)s, %(urgp)s, %(window)s, %(logtype)s, %(node_id)s, %(src_host)s, %(src_port)s, %(white)s, %(repo)s, %(ntp_cmd)s, %(args)s, %(cmd)s, %(banner_id)s, %(data)s, %(function)s, %(vnc_client_response)s, %(vnc_password)s, %(vnc_server_challenge)s, %(inputs)s, %(domain)s, %(headers_call_id)s, %(headers_content_length)s, %(headers_cseq)s, %(headers_from)s, %(headers_to)s, %(headers_via)s, %(community_string)s, %(requests)s, %(urg)s, %(psh)s, %(fin)s, %(appname)s, %(cltintname)s, %(database)s, %(language)s, %(servername)s, %(domainname)s)
{'function': '', 'domain': '', 'cmd': '', 'ntp_cmd': '', 'domainname': '', 'servername': '', 'skin': u'nasLogin', 'session': '', 'headers_via': '', 'ttl': '', 'headers_content_length': '', 'vnc_client_response': '', 'lenlen': '', 'headers_cseq': '', 'appname': '', 'inin': '', 'res': '', 'hostname': u'10.100.63.159', 'headers_to': '', 'prec': '', 'window': '', 'headers_call_id': '', 'white': 2, 'localversion': '', 'fin': '', 'vnc_password': '', 'dst_port': 80, 'username': u'', 'inputs': '', 'psh': '', 'df': '', 'args': '', 'syn': '', 'repo': '', 'mac': '', 'node_id': u'honey_opencanary_client-10.100.63.159', 'urgp': '', 'vnc_server_challenge': '', 'path': u'/index.html', 'cltintname': '', 'password': u'', 'data': '', 'banner_id': '', 'headers_from': '', 'language': '', 'database': '', 'honeycred': 0, 'idid': '', 'proto': '', 'community_string': '', 'logtype': 3001, 'dst_host': u'10.100.63.159', 'remoteversion': '', 'local_time': u'2019-04-25 07:06:15.227968', 'tos': '', 'useragent': u'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36', 'requests': '', 'src_host': u'172.16.60.22', 'src_port': 61695, 'outout': '', 'urg': ''}
ROLLBACK
200 POST /log/ (127.0.0.1) 13.31ms
所有的日志都插入不了吗?
不是的,"主机状态"这里的是可以正常写入数据,就关键的“攻击列表”这儿写不进去。
@oc-oc 加我微信吧 pirogue-tk 拉你进问题答疑的群
原因是OpencanaryLog表字段node_id的值太长,在大佬协助下解决了。
亲亲, 我的客户端部署好了,在/var/tmp/opencanary.log里面能查到日志,但是日志没有写入server端,在数据库表OpencanaryLog里面查不到日志,需要如何排查呢。