byrsapty
510ca37e48
- Two flood-detection alerts (per-source message volume, calibrated live against real traffic) grouped by gl2_remote_ip - Session correlation: accelppp_interface fallback tagging plus radius_session_id/calling_station_id/radius_username extraction, so a subscriber's full session lifecycle is searchable by one key - Replace the single combined dashboard with three focused ones (Overview & Alerts, Network Equipment, Servers & Sessions) - Propagate GRAYLOG_ROOT_TIMEZONE and IP-in-alerts fixes into the reusable install script and templates - Add a Forgejo Actions workflow (manual trigger) that re-runs install-graylog.sh on a self-hosted runner living in the container, automating the deploy step this project has done by hand all along Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 lines
1.4 KiB
JSON
5 lines
1.4 KiB
JSON
{
|
|
"title": "accelppp_radius_accounting",
|
|
"description": "accel-ppp: RADIUS Accounting-Request (session start/stop/alive/interim) - also extracts session-correlation fields (radius_session_id, calling_station_id, radius_username) so the full session lifecycle can be searched by one key",
|
|
"source": "rule \"accelppp_radius_accounting\"\nwhen\n contains(to_string($message.message), \"Accounting-Request\")\nthen\n set_field(\"vendor\", \"accel-ppp\");\n set_field(\"event_type\", \"radius_accounting\");\n let m = regex(\"(\\\\S+): send \\\\[RADIUS\\\\(\\\\d+\\\\) Accounting-Request.*?<User-Name \\\"(\\\\S+)\\\">.*?<NAS-Identifier \\\"(\\\\S+)\\\">.*?<Calling-Station-Id \\\"(\\\\S+)\\\">.*?<Acct-Status-Type (\\\\S+)>.*?<Acct-Session-Id \\\"(\\\\S+)\\\">.*?<Framed-IP-Address (\\\\S+)>\", to_string($message.message), [\"interface\",\"radius_username\",\"nas_identifier\",\"calling_station_id\",\"acct_status_type\",\"radius_session_id\",\"framed_ip\"]);\n set_field(\"accelppp_interface\", m[\"interface\"]);\n set_field(\"radius_username\", m[\"radius_username\"]);\n set_field(\"nas_identifier\", m[\"nas_identifier\"]);\n set_field(\"calling_station_id\", m[\"calling_station_id\"]);\n set_field(\"acct_status_type\", m[\"acct_status_type\"]);\n set_field(\"radius_session_id\", m[\"radius_session_id\"]);\n set_field(\"framed_ip\", m[\"framed_ip\"]);\nend"
|
|
}
|