Zurück
-
Titel
Encrypt All IP addresses in the Syslog-ng messages. -
Beschreibung
Using the following rewrite rules only encrypt the first IP address in a message while the remaining ones stay unchanged:
subst("((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])[.]){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))", "$(sha1 $0)", value("MESSAGE"));, -
Ursache
Not applicable -
Lösung
To replace every IPv4 addresses, it needs to use Global option (flags(global)) inside the rewrite rule as per below,
rewrite pseudonymize_ip_addresses_in_message {subst ("((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])[.]){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))", "$(sha1 $0)", value("MESSAGE") , flags(global));}; -
Weitere Informationen
https://support.oneidentity.com/technical-documents/syslog-ng-premium-edition/7.0.32/administration-guide/