cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-splunk/recipes/client.rb

@@ -0,0 +1,143 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: client
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# This recipe encapsulates a completely configured "client" - a
+# Universal Forwarder configured to talk to a node that is the splunk
+# server (with node['splunk']['is_server'] true). The recipes can be
+# used on their own composed in your own wrapper cookbook or role.
+include_recipe 'mu-splunk::user'
+include_recipe 'mu-splunk::install_forwarder'
+
+if node['splunk']['discovery'] == 'groupname'
+  splunk_servers = search(
+      :node,
+      "splunk_is_server:true AND splunk_groupname:#{node['splunk_groupname']}"
+  ).sort! do
+  |a, b|
+    a.name <=> b.name
+  end
+elsif node['splunk']['discovery'] == 'static'
+  splunk_servers = [
+      { "splunk" =>
+        {
+          "receiver_port" => node['splunk']['server_port'],
+          "receiver_ip" => node['splunk']['server_address']
+        }
+      }
+    ]
+else
+  splunk_servers = search(# ~FC003
+      :node,
+      "splunk_is_server:true AND chef_environment:#{node.chef_environment}"
+  ).sort! do
+  |a, b|
+    a.name <=> b.name
+  end
+end
+
+# ensure that the splunk service resource is available without cloning
+# the resource (CHEF-3694). this is so the later notification works,
+# especially when using chefspec to run this cookbook's specs.
+begin
+  resources('service[splunk]')
+rescue Chef::Exceptions::ResourceNotFound
+  service 'splunk' do
+    if node['platform_family'] == 'windows'
+      service_name 'SplunkForwarder'
+      provider Chef::Provider::Service::Windows
+      timeout 90
+      retries 3
+      retry_delay 10
+      supports :status => false, :restart => false
+      start_command "c:/Windows/system32/sc.exe start SplunkForwarder"
+      stop_command "c:/Windows/system32/sc.exe stop SplunkForwarder"
+      pattern "splunkd.exe"
+    else
+      provider Chef::Provider::Service::Init
+      supports :status => true, :restart => true
+    end
+    action :start
+  end
+end
+
+directory "#{splunk_dir}/etc/system/local" do
+  recursive true
+  if node['platform_family'] != 'windows'
+    owner node['splunk']['user']['username']
+    group node['splunk']['user']['username']
+  end
+end
+
+if node['splunk']['splunk_cloud_installer']
+  splunk_auth_info = chef_vault_item(node['splunk']['auth']['data_bag'], node['splunk']['auth']['data_bag_item'])['auth']
+  user, pw = splunk_auth_info.split(':')
+  execute "Install Splunk Cloud app" do
+    command "/opt/splunkforwarder/bin/splunk install app #{node['splunk']['install_spl_file']} -auth #{user}:#{pw}"
+    not_if "/opt/splunkforwarder/bin/splunk display app | grep ^splunkclouduf"
+  end
+end
+
+template "#{splunk_dir}/etc/system/local/outputs.conf" do
+  source 'outputs.conf.erb'
+  mode 0644 unless platform_family?("windows")
+  variables :splunk_servers => splunk_servers, :outputs_conf => node['splunk']['outputs_conf'], :ssl_chain => node['splunk']['ssl_chain'], :ssl_cert => node['splunk']['ssl_cert']
+#  notifies :restart, 'service[splunk]', :immediately if platform_family?("windows")
+  notifies :restart, 'service[splunk]', :delayed #unless platform_family?("windows")
+end
+
+template "#{splunk_dir}/etc/system/local/inputs.conf" do
+  source 'inputs.conf.erb'
+  mode 0644
+  variables :inputs_conf => node['splunk']['inputs_conf']
+  notifies :restart, 'service[splunk]', :delayed
+  not_if { node['splunk']['inputs_conf'].nil? || node['splunk']['inputs_conf']['host'].empty? }
+end
+if node['platform_family'] != 'windows'
+  directory "/opt/splunkforwarder/etc/apps"
+  directory "/opt/splunkforwarder/etc/apps/base_logs_unix"
+  directory "/opt/splunkforwarder/etc/apps/base_logs_unix/local"
+  template "#{splunk_dir}/etc/apps/base_logs_unix/local/inputs.conf" do
+    source 'base_logs_unix_inputs.conf.erb'
+    mode 0644
+    notifies :restart, 'service[splunk]', :delayed
+  end
+end
+
+include_recipe 'mu-splunk::service'
+include_recipe 'mu-splunk::setup_auth'
+
+svr_conf = "#{splunk_dir}/etc/system/local/server.conf"
+ruby_block "tighten SSL options in #{svr_conf}" do
+  block do
+    newfile = []
+    File.readlines(svr_conf).each { |line|
+      newfile << line
+      if line.match(/^\[sslConfig\]/)
+        newfile << "useClientSSLCompression = false\n"
+        newfile << "sslVersions = tls1.2\n"
+        newfile << "cipherSuite = TLSv1.2:!eNULL:!aNULL\n"
+      end
+    }
+    f = File.new(svr_conf, File::CREAT|File::TRUNC|File::RDWR)
+    f.puts newfile
+    f.close
+  end
+  not_if "grep ^sslVersions '#{svr_conf}'"
+  notifies :restart, 'service[splunk]', :delayed
+end

data/cookbooks/mu-splunk/recipes/default.rb

@@ -0,0 +1,31 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: default
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+if node['splunk']['disabled']
+  include_recipe 'mu-splunk::disabled'
+  Chef::Log.debug('Splunk is disabled on this node.')
+  return
+end
+
+if node['splunk']['is_server']
+  include_recipe 'mu-splunk::server'
+else
+  include_recipe 'mu-splunk::client'
+end

data/cookbooks/mu-splunk/recipes/disabled.rb

@@ -0,0 +1,41 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: disabled
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unless node['splunk']['disabled']
+  Chef::Log.debug('The mu-splunk::disabled recipe was added to the node,')
+  Chef::Log.debug('but the attribute to disable splunk was not set.')
+  return
+end
+
+service 'splunk' do
+  ignore_failure true
+  action :stop
+end
+
+%w(splunk splunkforwarder).each do |pkg|
+  package pkg do
+    ignore_failure true
+    action :remove
+  end
+end
+
+execute "#{splunk_dir}/bin/splunk disable boot-start" do
+  ignore_failure true
+end

data/cookbooks/mu-splunk/recipes/install_forwarder.rb

@@ -0,0 +1,23 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: install_forwarder
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+splunk_installer 'splunkforwarder' do
+  url node['splunk']['forwarder']['url']
+end

data/cookbooks/mu-splunk/recipes/install_server.rb

@@ -0,0 +1,23 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: install_server
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+splunk_installer 'splunk' do
+  url node['splunk']['server']['url']
+end

data/cookbooks/mu-splunk/recipes/server.rb

@@ -0,0 +1,53 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: server
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+node.default['splunk']['is_server'] = true
+include_recipe 'mu-splunk::user'
+include_recipe 'mu-splunk::install_server'
+include_recipe 'mu-splunk::service'
+include_recipe 'mu-splunk::setup_auth'
+
+# We can rely on loading the chef_vault_item here, as `setup_auth`
+# above would have failed if there were another issue.
+splunk_auth_info = chef_vault_item(node['splunk']['auth']['data_bag'], node['splunk']['auth']['data_bag_item'])['auth']
+
+firewall_rule "HTTP ports for Splunk admin console" do
+  port [80, 443]
+end
+
+execute 'enable-splunk-receiver-port' do
+  command "\"#{splunk_cmd}\" enable listen #{node['splunk']['receiver_port']} -auth '#{splunk_auth_info}'"
+  not_if do
+    # TCPSocket will return a file descriptor if it can open the
+    # connection, and raise Errno::ECONNREFUSED if it can't. We rescue
+    # that exception and return false so not_if works proper-like.
+    begin
+      ::TCPSocket.new(node['ipaddress'], node['splunk']['receiver_port'])
+    rescue Errno::ECONNREFUSED
+      false
+    end
+  end
+end
+firewall_rule "Splunk receiver port(s)" do
+  port [node['splunk']['receiver_port'].to_i, 8089]
+end
+
+if node['splunk']['ssl_options']['enable_ssl']
+  include_recipe 'mu-splunk::setup_ssl'
+end

data/cookbooks/mu-splunk/recipes/service.rb

@@ -0,0 +1,95 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: service
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+myuser = 'root'
+unless node['splunk']['server']['runasroot']
+  myuser = node['splunk']['user']['username']
+end
+
+if node['splunk']['is_server']
+  directory splunk_dir do
+    owner myuser
+    group myuser
+    mode 00755
+  end
+
+  directory "#{splunk_dir}/var" do
+    owner node['splunk']['user']['username']
+    group node['splunk']['user']['username']
+    mode 00711
+  end
+
+  directory "#{splunk_dir}/var/log" do
+    owner node['splunk']['user']['username']
+    group node['splunk']['user']['username']
+    mode 00711
+  end
+
+  directory "#{splunk_dir}/var/log/splunk" do
+    owner node['splunk']['user']['username']
+    group node['splunk']['user']['username']
+    mode 00700
+  end
+end
+
+if node['splunk']['accept_license'] and node['platform_family'] != 'windows'
+  execute "#{splunk_cmd} enable boot-start --accept-license --answer-yes" do
+#    not_if "grep -q -- '--no-prompt --answer-yes' /etc/init.d/splunk"
+  end
+end
+
+
+if node['platform_family'] != 'windows'
+  if node['splunk']['is_server']
+    chown_r_splunk("#{splunk_dir}/etc/users", myuser)
+    chown_r_splunk(splunk_dir, myuser)
+  end
+
+  template '/etc/init.d/splunk' do
+    source 'splunk-init.erb'
+    mode 0700
+    variables(
+        :splunkdir => splunk_dir,
+        :runasroot => node['splunk']['server']['runasroot']
+    )
+  end
+end
+
+begin
+  resources('service[splunk]')
+rescue Chef::Exceptions::ResourceNotFound
+  service 'splunk' do
+    if node['platform_family'] == 'windows'
+      service_name 'SplunkForwarder'
+      provider Chef::Provider::Service::Windows
+      timeout 90
+      retries 3
+      retry_delay 10
+      supports :status => false, :restart => false
+      start_command "c:/Windows/system32/sc.exe start SplunkForwarder"
+      stop_command "c:/Windows/system32/sc.exe stop SplunkForwarder"
+      pattern "splunkd.exe"
+    else
+      provider Chef::Provider::Service::Init
+      supports :status => true, :restart => true
+    end
+    action :start
+  end
+end

data/cookbooks/mu-splunk/recipes/setup_auth.rb

@@ -0,0 +1,49 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: setup_auth
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+include_recipe 'chef-vault'
+
+splunk_auth_info = chef_vault_item(node['splunk']['auth']['data_bag'], node['splunk']['auth']['data_bag_item'])['auth']
+user, pw = splunk_auth_info.split(':')
+
+
+if node['platform_family'] != 'windows'
+  guard_path = "#{splunk_dir}/etc/.setup_#{user}_password"
+  file "guard setup_#{user}_password" do
+    path guard_path
+    content 'true\n'
+    owner node['splunk']['user']['username']
+    group node['splunk']['user']['username']
+    mode 00600
+    action :nothing
+  end
+else
+  guard_path = "#{splunk_dir}\\etc\\setup_#{user}_password"
+  file "guard setup_#{user}_password" do
+    path guard_path
+    content 'true\n'
+    action :nothing
+  end
+end
+
+execute 'change-admin-user-password-from-default' do
+  command "\"#{splunk_cmd}\" edit user #{user} -password '#{pw}' -role admin -auth admin:changeme"
+  not_if { ::File.exist?(guard_path) }
+  notifies :create, "file[guard setup_#{user}_password]", :immediately
+end

data/cookbooks/mu-splunk/recipes/setup_ssl.rb

@@ -0,0 +1,63 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: setup_ssl2
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+unless node['splunk']['ssl_options']['enable_ssl']
+  Chef::Log.debug('The mu-splunk::setup_ssl recipe was added to the node,')
+  Chef::Log.debug('but the attribute to enable SSL was not set.')
+  return
+end
+
+include_recipe 'chef-vault'
+ssl_options = node['splunk']['ssl_options']
+
+certs = chef_vault_item(
+    ssl_options['data_bag'],
+    ssl_options['data_bag_item']
+)['data']
+
+# ensure that the splunk service resource is available without cloning
+# the resource (CHEF-3694). this is so the later notification works,
+# especially when using chefspec to run this cookbook's specs.
+begin
+  resources('service[splunk]')
+rescue Chef::Exceptions::ResourceNotFound
+  service 'splunk'
+end
+
+template "#{splunk_dir}/etc/system/local/web.conf" do
+  source 'system-web.conf.erb'
+  variables ssl_options
+  notifies :restart, 'service[splunk]'
+end
+
+file "#{splunk_dir}/etc/auth/splunkweb/#{ssl_options['keyfile']}" do
+  content certs[ssl_options['keyfile']]
+  owner node['splunk']['user']['username']
+  group node['splunk']['user']['username']
+  mode 00600
+  notifies :restart, 'service[splunk]'
+end
+
+file "#{splunk_dir}/etc/auth/splunkweb/#{ssl_options['crtfile']}" do
+  content certs[ssl_options['crtfile']]
+  owner node['splunk']['user']['username']
+  group node['splunk']['user']['username']
+  mode 00600
+  notifies :restart, 'service[splunk]'
+end

data/cookbooks/mu-splunk/recipes/upgrade.rb

@@ -0,0 +1,94 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: upgrade
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unless node['splunk']['upgrade_enabled']
+  Chef::Log.fatal('The mu-splunk::upgrade recipe was added to the node,')
+  Chef::Log.fatal('but the attribute `node["splunk"]["upgrade_enabled"]` was not set.')
+  Chef::Log.fatal('I am bailing here so this node does not upgrade.')
+  raise
+end
+
+service 'splunk_stop' do
+  if node['platform_family'] != 'windows'
+    service_name 'splunk'
+    provider Chef::Provider::Service::Init
+    only_if { ::File.exists?("/etc/init.d/splunk") }
+  else
+    service_name 'SplunkForwarder'
+    provider Chef::Provider::Service::Windows
+    timeout 90
+    retries 3
+    retry_delay 10
+    supports :status => false, :restart => false
+    start_command "c:/Windows/system32/sc.exe start SplunkForwarder"
+    stop_command "c:/Windows/system32/sc.exe stop SplunkForwarder"
+    pattern "splunkd.exe"
+    only_if { ::Dir.exists?("c:/Program Files/SplunkUniversalForwarder") }
+    not_if { ::Dir.glob("c:/Program Files/SplunkUniversalForwarder/splunkforwarder-#{node['splunk']['preferred_version']}-*").size > 0 }
+  end
+  supports :status => true
+  action :stop
+end
+
+if node['platform_family'] == 'windows'
+  # Splunk can't seem to upgrade itself in some cases if we don't explicitly
+  # purge the old installation.
+  powershell_script "Purge old versions of Splunk Universal Forwarder" do
+    guard_interpreter :powershell_script
+    code <<-EOH
+      wmic product get /format:csv | findstr /i UniversalForwarder | findstr /i /v splunkforwarder-#{node['splunk']['preferred_version']}- | foreach {
+        $fields = $_.split(",")
+        $arg1 = "/x"+$fields[6]
+        $arg2 = "/quiet"
+        msiexec $arg1 $arg2
+      }
+    EOH
+    not_if { ::Dir.glob("c:/Program Files/SplunkUniversalForwarder/splunkforwarder-#{node['splunk']['preferred_version']}-*").size > 0 }
+    only_if { ::Dir.exists?("c:/Program Files/SplunkUniversalForwarder") }
+  end
+end
+
+
+
+if node['splunk']['is_server']
+  splunk_package = 'splunk'
+  url_type = 'server'
+else
+  splunk_package = 'splunkforwarder'
+  url_type = 'forwarder'
+end
+
+splunk_installer splunk_package do
+  url node['splunk'][url_type]["url"]
+  if node['splunk']['accept_license']
+    notifies :run, "execute[splunk-unattended-upgrade]", :immediately
+  end
+end
+
+if node['splunk']['accept_license']
+  execute 'splunk-unattended-upgrade' do
+    command "\"#{splunk_cmd}\" start --accept-license --answer-yes"
+    action :nothing
+  end
+else
+  Chef::Log.fatal('You did not accept the license (set node["splunk"]["accept_license"] to true)')
+  Chef::Log.fatal('Splunk is stopped and cannot be restarted until the license is accepted!')
+  raise
+end

data/cookbooks/mu-splunk/recipes/user.rb

@@ -0,0 +1,34 @@
+#
+# Cookbook Name:: splunk
+# Recipe:: user
+#
+# Author: Joshua Timberman <joshua@getchef.com>
+# Copyright (c) 2014, Chef Software, Inc <legal@getchef.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+if node['platform_family'] != 'windows'
+  group node['splunk']['user']['username'] do
+    gid node['splunk']['user']['uid'].to_i # CHEF-4927
+    system true if %w(linux).include?(node['os'])
+  end
+
+  user node['splunk']['user']['username'] do
+    comment node['splunk']['user']['comment']
+    shell node['splunk']['user']['shell']
+    gid node['splunk']['user']['username']
+    uid node['splunk']['user']['uid']
+    system true if %w(linux).include?(node['os'])
+  end
+end

data/cookbooks/mu-splunk/templates/default/base_logs_unix_inputs.conf.erb

@@ -0,0 +1,26 @@
+[monitor:///var/log/messages]
+disabled = false
+followTail = 0
+
+[monitor:///var/log/secure]
+disabled = false
+followTail = 0
+
+[monitor:///var/log/maillog]
+disabled = false
+followTail = 0
+
+[monitor:///var/log/cron]
+disabled = false
+followTail = 0
+
+
+[monitor:///var/log/httpd/access_log]
+disabled = false
+followTail = 0
+sourcetype = access_combined
+
+[monitor:///var/log/httpd/error_log]
+disabled = false
+followTail = 0
+sourcetype = apache_error