Igama lomsebenzisi le-VPN lanyamalala kuphi kumzila wamalogi?
Qhathanisa umcimbi wesango, ikhophi eluhlaza yomqoqi, umcimbi osenkambisweni yezinkomba kanye nensimu ngesikhathi sokusesha ngaphambi kokushintsha ukulawulwa kobumfihlo bamalogi.
Amaseshini ayavela kudashibhodi kuyilapho ikholomu yegama lomsebenzisi ihlala ingenalutho, futhi umgogodla wokuqala ukusola umhlaziyi. Lowo mgogodla weqa izigaba ezintathu zangaphambilini lapho inani lingase lahleka khona. Isango lingafihla ubunikazi ngokwenqubomgomo, umthetho wokungenisa ungayisusa ngaphambi kokufakwa kwezinkomba, futhi ukukhishwa ngesikhathi sokusesha kungase kwehluleke nje ukuyibiza ngegama. Ukulungiswa kuncike ekutheni iyiphi imingcele ongayifakazela ukuthi iyona ebhekene necala, ngakho umsebenzi owusizo ukuqhathanisa, hhayi ukulungisa.
Qala ngomcimbi owodwa, hhayi ngedashibhodi
Khetha umcimbi owodwa wokuqinisekisa futhi ubhale okhuwukhombisayo: imodeli nenguqulo yesango, indlela yokuqinisekisa, isihlonzi somcimbi, uphawu lwesikhathi kanye nekheli lomthombo. Faka igama lomsebenzisi ngendlela efanayo ncamashi naleyo umuntu alithayipha ngayo, kuhlanganise nofundolwazi ezinkulu nezincane, ngoba ukusesha okubheka usayizi wamagama kungafihla insimu ekhona. Thatha lowo mcimbi njengereferensi yakho konke ukuqhathanisa kwakamuva.
Izinhlobo zemicimbi azihlanganyeli isikimu esisodwa. Umzamo ohlulekile, ukungena okuphumelelayo ngaphandle kwekhasimende kanye nokuxhuma kabusha kwethumbu kungaveza izinsimu ezihlukene, futhi amanye amasango ayashiya ubunikazi lapho umzamo ungakaze ufinyelele ukuqinisekiswa komsebenzisi. Ngakho ikholomu engenalutho ohlotsheni olulodwa lomcimbi iwubufakazi obuthaka benkinga yomzila.
Sebenza ngobunikazi bokuhlola obugunyaziwe esikhundleni se-akhawunti yomsebenzi yangempela, futhi gcina ukuqhathanisa ngaphakathi kwemithetho yokufinyelela esevele ilawula idatha yamalogi. Ukuvula kabanzi ukubhalwa kwemilog yokuqinisekisa enemininingwane ukuze nje kutholakale isampula kushintsha uhlelo oluzama ukulukala.
Qhathanisa imingcele emine ngokulandelana
Inani linganyamalala kwelinye lamaphoyinti amane. Iphoyinti ngalinye linomnini ohlukile nokulungiswa okuhlukile.
| Boundary | What to compare | A gap means |
|---|---|---|
| Gateway event view | The device's own event display and logging policy | The identity was masked or never emitted |
| Collector receive | The raw event as received, before parsing | Transport, filter or source selection dropped it |
| Index-time pipeline | Transforms applied before storage | Redaction or rewriting removed the value |
| Search-time extraction | The field name and regex used by the query | The label does not match the stored key |
Ma kumngcele wokuqala lapho inani linyamalala khona. Ukungafani phakathi kombono wedivayisi nekhophi eluhlaza kukhombisa ukuthutha noma ukulungiselelwa komqoqi; ukuvumelana lapho kodwa inani elingekho kumcimbi osenkambisweni yezinkomba kukhombisa uguquko; inani elikhona kumcimbi osenkambisweni yezinkomba kodwa elingekho kudashibhodi likhombisa ukukhishwa noma umbuzo.
Lokhu kulandelana kubalulekile ngoba isigaba ngasinye sakamuva singalahlekelwa ulwazi kuphela, asikwazi ukulubuyisa. Isisho esivamile asikwazi ukubuyisa umucu owashintshwa isigaba sangaphambilini ngophawu lokubamba indawo, futhi ukulungiselelwa kobumfihlo akukwazi ukuchaza inani elingakaze lithunyelwe.
Ukufihla emthonjeni kuyinqubomgomo, akuyona iphutha lomhlaziyi
Imibhalo yokubhalwa kwamalogi ye-ASA yakwa-Cisco ichaza ukufihlwa kwegama lomsebenzisi njengokuziphatha okungalungiselelwa, kuhlanganise nendlela amagama omsebenzisi angavumelekile noma angaziwa aboniswa ngayo. Ngakho ubunikazi obufihliwe kumcimbi womthombo bungaba yikho kanye okudingwa inqubomgomo yobumfihlo, futhi ukubuthatha njengokwehluleka kokuhlaziya kuholela esicelweni esenza buthaka ukulawula.
Isethulo esiqondile sincike kunguqulo nasehlotsheni somyalezo. Umcimbi owodwa ungase ube nophawu lokubamba indawo, omunye ungase ushiye insimu ngokuphelele, futhi ukwehluleka kokuqinisekisa kungase kungabi nalo igama nhlobo. Hlola ukuziphatha okubhaliwe komcimbi othile esikhundleni sokusebenzisa umbiko wakudala wephutha kubo bonke ubunikazi obungekho.
Lapho ukufihla kunenjongo, umbuzo usuka ekutheni insimu ingabuyiswa kanjani uye ekutheni ingabe isidingo somcwaningi singahlangatshezwa ngenye indlela. Izihlonzi zamaseshini, imephu yobunikazi elawulwayo ephethwe iqembu elincane, noma ukugeleza kwemicimbi okugunyaziwe okuncane kuvame ukwanelisa isidingo ngaphandle kokubeka wonke amagama omsebenzisi azanyiwe phambi komfundi ngamunye wamalogi.
Ukungaziwa ngaphambi kwezinkomba akukwazi ukuhoxiswa
Imibhalo yakwa-Splunk mayelana nokucubungula imicimbi ichaza ukungaziwa ngokusebenzisa izisho ze-sed kanye nezinguquko ezibhala kabusha noma zisuse idatha ngaphambi kwezinkomba. Yilapho kanye lapho iphuzu likhona: umcimbi oluhlaza ushintshwa lapho ungena, ngakho ukukhishwa ngesikhathi sokusesha akusenalutho engakuthola.
Ukuhlela ngesikhathi sezinkomba nokukhishwa kwezinsimu ngesikhathi sokusesha kuxazulula izinkinga ezihlukene. Ukuhlela kukhawulela ukuthi ubani angake abone inani; ukukhishwa kunquma kuphela ukuthi umbuzo usebenzisa liphi igama. I-hashing iyindlela ephakathi egcina ukuhlobana, kodwa i-hash ezinzile endaweni encane yamagama omsebenzisi isakwazi ukukhomba lapho othile engahlola amagama angaba khona kuyo.
Uma umcimbi ogciniwe usanobunikazi, inkinga isezansi: uhlobo lomthombo, ukwehlukaniswa kwemigqa, ukuphathwa kwezihlukanisi, amagama angamanye ezinsimu noma umbuzo uqobo. Lokho kuwukulungiswa kokuhlaziya okuvamile futhi akuthinti umngcele wobumfihlo.
Khetha ukulungiswa okuhambisana nomngcele
Izimo ezintathu zinquma impendulo. Okokuqala, ingabe inqubomgomo yobumfihlo ihlose ukukhipha ubunikazi? Okwesibili, ingabe inqubo yokucwaninga noma yokuphenya idinga ubunikazi, igama lokufanisa, noma iseshini kuphela? Okwesithathu, yimuphi umngcele lapho inani lidingeka khona — ukuqoqwa, ukugcinwa noma ukwethulwa?
Uma inqubomgomo ihlose ukukhipha, shintsha isidingo noma ukwethulwa, hhayi ukulawula. Uma inqubomgomo ivumela ubunikazi kodwa ukuqoqwa kuyaluphosa, lungisa umqoqi futhi uqinisekise umcimbi oluhlaza. Uma ukugcinwa kuphelele, lungisa ukukhishwa futhi ukuhlole ngokumelene nomcimbi ogunyaziwe owawuthatha ekuqaleni.
Vala uphenyo ngokusho umngcele kurekhodi loshintsho: kufihlwe emthonjeni, kususwe ngesikhathi sokungenisa, noma kuphoswe ukukhishwa. Lowo musho owodwa utshela unjiniyela olandelayo ukuthi aqale abheke kuphi, futhi uvimbela isikhalazo sedashibhodi ukuthi siphenduke isici sobumfihlo esivalwe buthule.