Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser dengan label penyerapan
KEMP_LOADBALANCER.
Mengonfigurasi Kemp Load Balancer
Login ke konsol Kemp Load Balancer.
Pilih Opsi logging>Opsi Syslog.
Di bagian Syslog options, di salah satu kolom yang tersedia, tentukan alamat IP penerusan Google Security Operations.
Sebaiknya tentukan alamat IP di kolom Info host.
Klik Ubah parameter syslog.
Mengonfigurasi penerus Google Security Operations untuk memproses log Kemp Load Balancer
Pilih Setelan SIEM>Forwarder.
Klik Tambahkan penerusan baru.
Di kolom Nama penerusan, masukkan nama unik untuk penerusan.
Klik Kirim, lalu klik Konfirmasi. Forwarder ditambahkan dan jendela Add collector configuration akan muncul.
Di kolom Collector name, ketik nama unik untuk pengumpul.
Pilih Kemp Load Balancer sebagai Log type.
Pilih Syslog sebagai Collector type.
Konfigurasikan parameter input wajib berikut:
Protokol: tentukan protokol koneksi yang digunakan pengumpul untuk memproses data syslog.
Alamat: tentukan alamat IP atau nama host target tempat pengumpul berada dan memproses data syslog.
Port: tentukan port target tempat pengumpul berada dan memproses data syslog.
Parser ini mengekstrak kolom dari pesan syslog Kemp Load Balancer berdasarkan kolom log_number, lalu memetakannya ke UDM. Fitur ini menangani berbagai format log menggunakan pola grok dan logika bersyarat, mengonversi jenis data, serta memperkaya peristiwa dengan metadata seperti jenis peristiwa, protokol aplikasi, dan hasil keamanan.
Tabel pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
collection_time.seconds
metadata.event_timestamp.seconds
Waktu pengumpulan log digunakan sebagai stempel waktu peristiwa jika timestamp tidak ada. Nanodetik dipotong.
Pasangan nilai kunci dari log berformat CEF. Digunakan untuk mengekstrak berbagai kolom.
log_event
metadata.product_event_type
Jenis peristiwa dari log berformat CEF.
log_time
metadata.event_timestamp.seconds
Stempel waktu log. Dikonversi ke format Chronicle dan digunakan sebagai stempel waktu peristiwa. Nanodetik dipotong.
msg/message
Lihat data
Berisi pesan log utama. Lihat data untuk mengetahui detail pemetaan UDM.
pid
target.process.pid
ID Proses.
resource
target.url
Resource diakses.
srcip
principal.ip
Alamat IP sumber.
src_ip
principal.ip
Alamat IP sumber.
srcport
principal.port
Port sumber.
src_port
principal.port
Port sumber.
sshd
target.application
Nama daemon SSH.
ringkasan
security_result.summary
Ringkasan hasil keamanan.
timestamp.seconds
events.timestamp.seconds
Stempel waktu entri log. Digunakan sebagai stempel waktu peristiwa jika ada.
pengguna
target.user.userid
Nama pengguna.
vs
target.ip | target.port
IP dan port server virtual. IP dipetakan ke target.ip. Port dipetakan ke target.port jika dstport tidak ada.
vs_port
target.port
Port server virtual. Ditentukan oleh logika berdasarkan log_number, dest_port, login_status, dan log_event. Nilai yang mungkin mencakup GENERIC_EVENT, NETWORK_HTTP, NETWORK_CONNECTION, USER_LOGIN, dan USER_UNCATEGORIZED. Dikodekan secara permanen ke "KEMP_LOADBALANCER". Dikodekan secara permanen ke "KEMP_LOADBALANCER". Dikodekan secara permanen ke "KEMP". Ditentukan oleh dest_port. Nilai yang mungkin adalah HTTP (port 80) dan HTTPS (port 443). Ditentukan oleh login_status dan audit_msg. Nilai yang mungkin adalah ALLOW dan BLOCK. Ditentukan oleh audit_msg. Nilai yang mungkin adalah ERROR. Disetel ke "AUTHTYPE_UNSPECIFIED" untuk peristiwa USER_LOGIN.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis document explains how to collect Kemp Load Balancer logs using a Google Security Operations forwarder, which supports parsing logs with the \u003ccode\u003eKEMP_LOADBALANCER\u003c/code\u003e ingestion label.\u003c/p\u003e\n"],["\u003cp\u003eTo configure Kemp Load Balancer, you must specify the IP address of the Google Security Operations forwarder in the Syslog options, and then add a new forwarder and collector in SIEM Settings with specific details including protocol, address, and port.\u003c/p\u003e\n"],["\u003cp\u003eThe parser extracts various fields from Kemp Load Balancer syslog messages, based on the log number, mapping them to the UDM, and includes fields such as \u003ccode\u003eprincipal.ip\u003c/code\u003e, \u003ccode\u003etarget.ip\u003c/code\u003e, \u003ccode\u003enetwork.http.method\u003c/code\u003e, and \u003ccode\u003esecurity_result.summary\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe document provides a detailed UDM mapping table showing how Kemp Load Balancer log fields are mapped to UDM fields, along with the logic used for data conversion and enrichment.\u003c/p\u003e\n"],["\u003cp\u003eRecent updates include improvements to the parsers that now includes events like "connected", "slave accept", and "block access to host", alongside mapping of additional fields like source and destination IPs and ports.\u003c/p\u003e\n"]]],[],null,["# Collect Kemp Load Balancer logs\n===============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect Kemp Load Balancer logs by using a\nGoogle Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser which normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the\n`KEMP_LOADBALANCER` ingestion label.\n\nConfigure Kemp Load Balancer\n----------------------------\n\n1. Sign in to the **Kemp Load Balancer** console.\n2. Select **Logging options** \\\u003e **Syslog options**.\n3. In the **Syslog options** section, in any of the available fields specify the\n IP address of the Google Security Operations forwarder.\n\n It is recommended to specify the IP address in the **Info host** field.\n4. Click **Change syslog parameters**.\n\nConfigure Google Security Operations forwarder to ingest Kemp Load Balancer logs\n--------------------------------------------------------------------------------\n\n1. Select **SIEM Settings** \\\u003e **Forwarders**.\n2. Click **Add new forwarder**.\n3. In the **Forwarder name** field, enter a unique name for the forwarder.\n4. Click **Submit** and then click **Confirm** . The forwarder is added and the **Add collector configuration** window appears.\n5. In the **Collector name** field, type a unique name for the collector.\n6. Select **Kemp Load Balancer** as the **Log type**.\n7. Select **Syslog** as the **Collector type**.\n8. Configure the following mandatory input parameters:\n - **Protocol**: specify the connection protocol that the collector uses to listen to syslog data.\n - **Address**: specify the target IP address or hostname where the collector resides and listens to syslog data.\n - **Port**: specify the target port where the collector resides and listens to syslog data.\n9. Click **Submit**.\n\nFor more information about the Google Security Operations forwarders, see [Manage forwarder configurations through the Google Security Operations UI](/chronicle/docs/install/forwarder-management-configurations).\n\nIf you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/getting-support).\n\nField mapping reference\n-----------------------\n\nThis parser extracts fields from Kemp Load Balancer syslog messages based on the `log_number` field, mapping them to the UDM. It handles various log formats using `grok` patterns and conditional logic, converting data types and enriching events with metadata like event type, application protocol, and security results.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
