{"id":1353,"date":"2024-09-05T21:25:46","date_gmt":"2024-09-05T13:25:46","guid":{"rendered":"http:\/\/blue.yn.cn\/?p=1353"},"modified":"2024-10-21T21:26:39","modified_gmt":"2024-10-21T13:26:39","slug":"%e6%8a%8a%e4%ba%a4%e6%8d%a2%e6%9c%ba%e7%9a%84arp%e8%a1%a8%e9%a1%b9%e8%bd%ac%e5%ad%98%e5%88%b0elastic","status":"publish","type":"post","link":"http:\/\/blue.yn.cn\/?p=1353","title":{"rendered":"\u628a9306\u7684arp\u8868\u9879\u8f6c\u5b58\u5230elastic"},"content":{"rendered":"<p>\u5177\u4f53\u6d41\u7a0b\u5982\u4e0b\uff1a<\/p>\n<ol>\n<li><code>zabbix server<\/code>\u901a\u8fc7<code>shell<\/code>\u811a\u672c<code>snmpwalk<\/code>\u83b7\u53d6\u5230\u534e\u4e3a9306\u5404\u63a5\u53e3\u4e0b\u7684<code>arp<\/code>\u8868\u9879<\/li>\n<li><code>zabbix server<\/code>\u4e0a\u7684<code>filebeat<\/code>\u6536\u96c6\u597d<code>arp<\/code>\u8868\u9879\u4f20\u7ed9<code>logstash<\/code><\/li>\n<li><code>logstash<\/code>\u5bf9\u6570\u636e\u8fdb\u884c\u7ed3\u6784\u5316\u548c\u4e30\u5bcc<code>mac<\/code>\u5382\u5bb6\u4fe1\u606f\u540e\u4f20\u7ed9<code>elastic<\/code><\/li>\n<\/ol>\n<h3>zabbix web\u914d\u7f6e<\/h3>\n<ul>\n<li><code>zabbix web<\/code>\u914d\u7f6e\u81ea\u52a8\u53d1\u73b0\u89c4\u5219\uff0c\u81ea\u52a8\u53d1\u73b09306\u7aef\u53e3\u8fd0\u884c\u72b6\u6001\u4e3a<code>UP<\/code>\u7684\u7aef\u53e3\u4e14\u83b7\u53d6<code>UP<\/code>\u7aef\u53e3\u7684<code>index<\/code><\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725543342010.png\" alt=\"file\" \/><\/p>\n<p>discovery[{#IFOPERSTATUS},1.3.6.1.2.1.2.2.1.8,{#IFALIAS},1.3.6.1.2.1.31.1.1.1.18,{#IFNAME},.1.3.6.1.2.1.2.2.1.2]<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725543421363.png\" alt=\"file\" \/><\/p>\n<p>9306\u5f15\u7528\u914d\u7f6e\u597d\u7684\u81ea\u52a8\u53d1\u73b0\u89c4\u5219\u540e\uff0c\u81ea\u52a8\u83b7\u53d6\u5230<code>up<\/code>\u63a5\u53e3\u7684\u76d1\u63a7\u9879\u5982\u4e0b<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725543692428.png\" alt=\"file\" \/><\/p>\n<ul>\n<li>\u952e\u503c <code>net.if.status[ifOperStatus.39(GigabitEthernet1\/0\/33)]<\/code>\u4e2d\u768439\u5c31\u5bf9\u5e94\u63a5\u53e3\u7684\u7d22\u5f15\uff08<code>{#SNMPINDEX}<\/code>\uff09<\/li>\n<\/ul>\n<h3>zabbix server\u76f8\u5173\u914d\u7f6e<\/h3>\n<ul>\n<li><code>crontab<\/code>\u8ba1\u5212\u4efb\u52a1\u914d\u7f6e<\/li>\n<\/ul>\n<pre><code class=\"language-bash\"># \u6bcf\u969410\u5206\u949f\u628a9306\u7684arp\u4fdd\u5b58\u5230\/var\/log\/9306arp.log\u3002xxx\u4e3a\u63a5\u53e3\u5bf9\u5e94\u7684\u7d22\u5f15SNMPINDEX\n*\/10 * * * * bash -x \/usr\/lib\/zabbix\/externalscripts\/ipaddr_discovery.sh xxx xxx... &amp;&gt; \/tmp\/arp.log\n\n#\u6bcf\u5929\u51cc\u66683\u70b9\u6267\u884c\u5220\u96649306arp\u65e5\u5fd7\uff1bby:yujing 2024\/9\/2\n00 03 * * * bash -x \/opt\/delete_9306arp_log.sh &amp;&gt; \/tmp\/delete.log<\/code><\/pre>\n<p>\u76f8\u5173\u811a\u672c\u914d\u7f6e\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">cat \/opt\/delete_9306arp_log.sh\nfind \/var\/log\/ -type f -name &quot;9306arp*.log&quot;  -mtime +3   | xargs rm -f<\/code><\/pre>\n<pre><code class=\"language-bash\">cat \/usr\/lib\/zabbix\/externalscripts\/ipaddr_discovery.sh\n#!\/usr\/bin\/bash\n\nDate=$(date +%F)\n\nfor j in $@\ndo\narray_ip=($(snmpwalk -v 2c -c xxx x.x.x.x ipNetToMediaNetAddress.$j | awk -F &#039; &#039; &#039;{print $NF}&#039; | sort -t &quot;.&quot; -k4 -n))\n\n        for i in ${array_ip[@]}\n        do\n                mac_addr=($(snmpwalk -v 2c -c xxx x.x.x.x ipNetToMediaPhysAddress.$j.$i | awk -F &#039; &#039; &#039;{print $NF}&#039;))\n                full_mac=$(echo &quot;STRING: $mac_addr&quot; | perl -pe &quot;s\/(?&lt;=:|\\s)([a-f0-9A-F])(?=:|$)\/0\\1\/g&quot; | awk -F &#039;[ ]&#039; &#039;{print $NF}&#039;)\n                echo &quot;$i $full_mac $full_mac&quot;  &gt;&gt; \/var\/log\/9306arp_${Date}.log\n        done\ndone<\/code><\/pre>\n<ul>\n<li><code>zabbix server<\/code>\u4e0a\u7684<code>filebeat<\/code>\u914d\u7f6e<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">cat \/etc\/filebeat\/filebeat.yml\nfilebeat.inputs:\n- type: log\n  enabled: true\n  paths:\n    - \/var\/log\/9306arp*.log\n\noutput.logstash:\n  hosts: [&quot;x.x.x.x:5044&quot;]<\/code><\/pre>\n<h3>logstash\u4e0a\u7684\u914d\u7f6e<\/h3>\n<pre><code class=\"language-bash\">cat \/etc\/logstash\/conf.d\/network.logstash.conf\ninput {\n  beats {\n        add_field =&gt; {&quot;beatType&quot; =&gt; &quot;filebeat&quot;}\n        port =&gt; 5044\n        }\n}\nfilter {\nif [beatType] == &quot;filebeat&quot;{\n        grok {\n        match =&gt; { &quot;message&quot; =&gt; &quot;%{IP:srcip}\\s%{MAC:macaddr}\\s(?&lt;MAC1&gt;[A-Fa-f0-9]{2}):(?&lt;MAC2&gt;[A-Fa-f0-9]{2}):(?&lt;MAC3&gt;[A-Fa-f0-9]{2})&quot; }\n        add_field =&gt; { &quot;macprefix&quot; =&gt; &quot;%{MAC1}%{MAC2}%{MAC3}&quot; }\n        remove_field =&gt; [&quot;MAC1&quot;,&quot;MAC2&quot;,&quot;MAC3&quot;]\n      }\n        mutate {\n        add_field =&gt; { &quot;version&quot; =&gt; &quot;4&quot; }\n        uppercase =&gt; [&quot;macprefix&quot;]\n        }\n        translate {\n        field =&gt; &quot;macprefix&quot;\n        destination =&gt; &quot;macoui&quot;\n        ##\u6ca1\u67e5\u5230\u5c31\u6807\u4e00\u4e2ano_match\n        fallback =&gt; &quot;no_match&quot;\n        ##\u4e0b\u9762\u6807\u4e00\u4e0b\u5b57\u5178\u6587\u4ef6\u7684\u4f4d\u7f6e\n        dictionary_path =&gt; &quot;\/tmp\/macoui.yml&quot;\n        ##\u5b57\u5178\u6587\u4ef6\u53ef\u4ee5\u66f4\u65b0\u540e\u53ef\u4ee5\u76f4\u63a5\u8986\u76d6\uff0clogstash\u4f1a\u95f4\u9694\u65f6\u95f4\u8fc7\u6765\u770b\u770b\u8be5\u6587\u4ef6\u662f\u5426\u53d1\u751f\u6539\u53d8\u4e86\n        refresh_interval =&gt; 300\n        ##\u5982\u679c\u53d1\u73b0\u6587\u4ef6\u53d8\u4e86\u5c31\u91cd\u65b0\u52a0\u8f7d\uff0c\u9ed8\u8ba4\u52a8\u4f5c\u662fmerge\u5408\u5e76\uff0c\u672c\u4f8b\u4e2d\u6211\u4eec\u7528replace\uff0c\u8981\u786e\u4fdd\u8be5\u6587\u4ef6\u59cb\u7ec8\u662f\u6700\u5168\u7684\n        refresh_behaviour =&gt; &quot;replace&quot;\n     }\n  }\n        date {\n        match =&gt; [ &quot;syslog_timestamp&quot;, &quot;MMM  d HH:mm:ss&quot;, &quot;MMM dd HH:mm:ss&quot; ]\n        }\n        mutate {\n        remove_field =&gt; [&quot;message&quot;]\n        }\nif [version] == &quot;4&quot;{\n        elasticsearch {\n        hosts =&gt; [&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;]\n        user =&gt; &quot;elastic&quot;\n        password =&gt; &quot;xxxxxx&quot;\n        query_template =&gt; &quot;search-by-ipv4.json&quot;\n        index =&gt; &quot;ipaddrfordep&quot;\n        fields =&gt; {\n        &quot;department&quot; =&gt; &quot;[department]&quot;\n    }\n  }\n }\n}\noutput {\n if [beatType] == &quot;filebeat&quot;{\n    elasticsearch {\n      index =&gt; &quot;9306-arplog-%{+YYYY.MM.dd}&quot;\n      hosts =&gt; [&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;]\n      user =&gt; &quot;elastic&quot;\n      password =&gt; &quot;xxxxxx&quot;\n    }\n  }\n}<\/code><\/pre>\n<p>\u4e0b\u8f7d\u5f00\u6e90\u811a\u672c\u83b7\u53d6<code>mac<\/code>\u5730\u5740\u7684<code>oui<\/code><br \/>\n<a href=\"https:\/\/github.com\/Vigilant-LLC\/logstash-oui-scraper\">https:\/\/github.com\/Vigilant-LLC\/logstash-oui-scraper<\/a><br \/>\n\u4fdd\u5b58\u4e3a<code>mac.sh<\/code><br \/>\n\u8fd0\u884c<br \/>\n<code>sh mac.sh oui-scraper -d \/tmp<\/code><br \/>\n\u8fd9\u6761\u547d\u4ee4\u53ef\u4ee5\u628aIEEE\u91cc\u7684OUI\u5217\u8868\u76f4\u63a5\u53d6\u56de\u6765\uff0c\u800c\u4e14\u8fd8\u53ef\u4ee5\u81ea\u52a8\u8fdb\u884c\u683c\u5f0f\u5904\u7406<br \/>\n\u67e5\u770b<code>\/tmp<\/code>\u76ee\u5f55\u4e0b\u7684<\/p>\n<pre><code class=\"language-bash\">cat \/tmp\/oui-logstash.txt | wc -l\n36068\n\ntail \/tmp\/oui-logstash.txt\nBCB4FD  NXP Semiconductor (Tianjin) LTD.\n580987  Amazon Technologies Inc.\n94F717  CIG SHANGHAI CO LTD\n7C5184  Unis Flash Memory Technology(Chengdu)Co.,Ltd.\nE806EB  ShieldSOS LLC\n78202E  Skychers Creations ShenZhen Limited\nDC1ED5  Espressif Inc.\n946C04  EM Microelectronic\nE0C250  NETGEAR\nAC04AA  GoPro<\/code><\/pre>\n<p>\u8fd8\u9700\u5bf9<code>oui-logstash.txt<\/code>\u8fdb\u884c\u5904\u7406<\/p>\n<pre><code class=\"language-bash\"># \u9009\u8fd0\u884c\u8fd9\u4e2a\u547d\u4ee4\uff0c\u628a^M$\u53bb\u6389\uff1a\ncat oui-logstash.txt | tr -d &#039;\\r&#039; &gt; macoui.txt\n# \u8f6c\u4e3ayml\u683c\u5f0f\nsed -i  -e &#039;s\/^\/&quot;\/1&#039; -e &#039;s\/\\t\/&quot;: &quot;\/1&#039; -e &#039;s\/$\/&quot;\/g&#039; macoui.txt\ncp macoui.txt macoui.yml\n\ntail macoui.yml\n&quot;585924&quot;: &quot;Nanjing Simon Info Tech Co.,Ltd.&quot;\n&quot;909DAC&quot;: &quot;Infinix mobility limited&quot;\n&quot;24DE8A&quot;: &quot;Nokia Solutions and Networks GmbH &amp; Co. KG&quot;\n&quot;C8E5E0&quot;: &quot;HUAWEI TECHNOLOGIES CO.,LTD&quot;\n&quot;BCB4FD&quot;: &quot;NXP Semiconductor (Tianjin) LTD.&quot;\n&quot;580987&quot;: &quot;Amazon Technologies Inc.&quot;\n&quot;94F717&quot;: &quot;CIG SHANGHAI CO LTD&quot;\n&quot;E806EB&quot;: &quot;ShieldSOS LLC&quot;\n&quot;7C5184&quot;: &quot;Unis Flash Memory Technology(Chengdu)Co.,Ltd.&quot;\n&quot;78202E&quot;: &quot;Skychers Creations ShenZhen Limited&quot;<\/code><\/pre>\n<h3>elastic\u914d\u7f6e\uff08\u5728kibana\u4e0a\u914d\u7f6e\uff09<\/h3>\n<ol>\n<li>\u914d\u7f6e\u7d22\u5f15\u6a21\u677f<code>9306-arplog-template<\/code><\/li>\n<\/ol>\n<ul>\n<li>\u6620\u5c04\u5982\u4e0b\u914d\u7f6e\uff1a<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725546507246.png\" alt=\"file\" \/><\/p>\n<ul>\n<li>\u751f\u547d\u5468\u671f\u5982\u4e0b\u914d\u7f6e<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725546612344.png\" alt=\"file\" \/><\/p>\n<ol start=\"2\">\n<li>\u7d22\u5f15\u7ba1\u7406<br \/>\n\u914d\u7f6e\u597d\u540e\u5728\u7d22\u5f15\u7ba1\u7406\u4e0a\u4f1a\u770b\u5230\u540d\u79f0\u4e3a<code>9306-arplog-2024.09.02<\/code>\u7684\u7d22\u5f15<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725549356036.png\" alt=\"file\" \/><\/p>\n<p>\u7136\u540e\u6dfb\u52a0\u597d<code>9306-arplog*<\/code>\u7684\u7d22\u5f15\u6a21\u5f0f<\/p>\n<ol start=\"3\">\n<li><code>discover<\/code>\u83dc\u5355<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725549435086.png\" alt=\"file\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5177\u4f53\u6d41\u7a0b\u5982\u4e0b\uff1a zabbix server\u901a\u8fc7shell\u811a\u672csnmpwalk\u83b7\u53d6\u5230\u534e\u4e3a9306\u5404\u63a5\u53e3\u4e0b\u7684arp&#8230; &raquo; <a class=\"read-more-link\" href=\"http:\/\/blue.yn.cn\/?p=1353\">\u9605\u8bfb\u5168\u6587<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-1353","post","type-post","status-publish","format-standard","hentry","category-elk"],"_links":{"self":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1353"}],"version-history":[{"count":8,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1353\/revisions"}],"predecessor-version":[{"id":1580,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1353\/revisions\/1580"}],"wp:attachment":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1353"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}