fluent-plugin-filter-parse-audit-log 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +1 -0
  3. data/README.md +38 -3
  4. data/fluent-plugin-filter-parse-audit-log.gemspec +1 -1
  5. data/lib/fluent/plugin/filter_parse_audit_log.rb +3 -2
  6. data/lib/fluent_plugin_filter_parse_audit_log/version.rb +1 -1
  7. metadata +4 -6
  8. data/gemfiles/fluentd_0.12.gemfile.lock +0 -73
  9. data/gemfiles/fluentd_0.14.gemfile.lock +0 -76
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 1dab94129a17f2aeb9eda08c28c95de6c73e0e1fd1953069d9795dba32acbdf2
4
- data.tar.gz: e4299fb0a3102f98c6efdd39eee9c0a7f37aa0e37d49f811a5097a3920c7aa5d
3
+ metadata.gz: 800c1ba3742e0a1fd76864255646610a48f32a4594ddf547731c0450e34f0a21
4
+ data.tar.gz: 4bc4de38894afb85a510df790072c5f396e15a2be69f8733c10d5d61ea44e013
5
5
  SHA512:
6
- metadata.gz: 5d794eb895d4335d50aa32ce84d2f35b562f1f8d65890c44984f266bbc9b46bcb917e21a11a8a38df3680aa518201ef4ddc52f2e1638ed4e4181d33f94945576
7
- data.tar.gz: e72d244dfc839cb54ee3d0e7ec12c4ba19b1f662af26d48558bc55a8b408fc7bd780e71fbabdda30d05dcf5881b7ce8115ae340818ff43e651b94dd99a8aa9a9
6
+ metadata.gz: f7c633fc97e6abb3c58be509aac6c7bf23aa94518650ba5716d01464827ca9932c32883ac8486a2e8c2510fd1c4df13093173806e8cd5a22b96b0a4d9393af52
7
+ data.tar.gz: 9b2a158848040d424b36fec749eed6e10d718293f9ab651b56c37acb167195e60ef48fe950df754da93922465fafd1641fa9fa89777ac72ee4a50c2469a44300
data/.gitignore CHANGED
@@ -8,6 +8,7 @@
8
8
  /tmp/
9
9
  Gemfile.lock
10
10
  /test/
11
+ /gemfiles/*.lock
11
12
 
12
13
  # rspec failure tracking
13
14
  .rspec_status
data/README.md CHANGED
@@ -26,9 +26,10 @@ Or install it yourself as:
26
26
  ```
27
27
  @type parse_audit_log
28
28
  #key message
29
+ #flatten false
29
30
  ```
30
31
 
31
- ## Example
32
+ ## Output
32
33
 
33
34
  ```
34
35
  <source>
@@ -45,11 +46,45 @@ Or install it yourself as:
45
46
  ```
46
47
 
47
48
  ```sh
48
- echo '{"message":"type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm=\"cat\" exe=\"/bin/cat\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"sshd_config\""}' | fluent-cat -t audit.log
49
+ echo '{"message":"type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm=\"cat\" exe=\"/bin/cat\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"sshd_config\""}' \
50
+ | fluent-cat -t audit.log
49
51
  ```
50
52
 
51
53
  ```json
52
- 2018-11-04 11:48:05.000000000 +0900 audit.log: {"header":{"type":"SYSCALL","msg":"audit(1364481363.243:24287)"},"body":{"arch":"c000003e","syscall":"2","success":"no","exit":"-13","a0":"7fffd19c5592","a1":"0","a2":"7fffd19c4b50","a3":"a","items":"1","ppid":"2686","pid":"3538","auid":"500","uid":"500","gid":"500","euid":"500","suid":"500","fsuid":"500","egid":"500","sgid":"500","fsgid":"500","tty":"pts0","ses":"1","comm":"\"cat\"","exe":"\"/bin/cat\"","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","key":"\"sshd_config\""}}
54
+ {
55
+ "header": {
56
+ "type": "SYSCALL",
57
+ "msg": "audit(1364481363.243:24287)"
58
+ },
59
+ "body": {
60
+ "arch": "c000003e",
61
+ "syscall": "2",
62
+ "success": "no",
63
+ "exit": "-13",
64
+ "a0": "7fffd19c5592",
65
+ "a1": "0",
66
+ "a2": "7fffd19c4b50",
67
+ "a3": "a",
68
+ "items": "1",
69
+ "ppid": "2686",
70
+ "pid": "3538",
71
+ "auid": "500",
72
+ "uid": "500",
73
+ "gid": "500",
74
+ "euid": "500",
75
+ "suid": "500",
76
+ "fsuid": "500",
77
+ "egid": "500",
78
+ "sgid": "500",
79
+ "fsgid": "500",
80
+ "tty": "pts0",
81
+ "ses": "1",
82
+ "comm": "\"cat\"",
83
+ "exe": "\"/bin/cat\"",
84
+ "subj": "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023",
85
+ "key": "\"sshd_config\""
86
+ }
87
+ }
53
88
  ```
54
89
 
55
90
  ## Related Links
data/fluent-plugin-filter-parse-audit-log.gemspec CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
23
23
  spec.require_paths = ['lib']
24
24
 
25
25
  spec.add_dependency 'fluentd'
26
- spec.add_dependency 'audit_log_parser'
26
+ spec.add_dependency 'audit_log_parser', '>= 0.1.2'
27
27
  spec.add_development_dependency 'bundler'
28
28
  spec.add_development_dependency 'rake'
29
29
  spec.add_development_dependency 'rspec', '~> 3.0'
data/lib/fluent/plugin/filter_parse_audit_log.rb CHANGED
@@ -4,12 +4,13 @@ require 'audit_log_parser'
4
4
  class FluentParseAuditLogFilter < Fluent::Filter
5
5
  Fluent::Plugin.register_filter('parse_audit_log', self)
6
6
 
7
- config_param :key, :string, :default => 'message'
7
+ config_param :key, :string, default: 'message'
8
+ config_param :flatten, :bool, default: false
8
9
 
9
10
  def filter(tag, time, record)
10
11
  line = record[@key]
11
12
  return record unless line
12
- AuditLogParser.parse_line(line)
13
+ AuditLogParser.parse_line(line, flatten: @flatten)
13
14
  rescue => e
14
15
  log.warn "failed to parse a audit log: #{line}", error_class: e.class, error: e.message
15
16
  log.warn_backtrace
data/lib/fluent_plugin_filter_parse_audit_log/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module FluentPluginFilterParseAuditLog
2
- VERSION = '0.1.0'
2
+ VERSION = '0.1.1'
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: fluent-plugin-filter-parse-audit-log
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.0
4
+ version: 0.1.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - winebarrel
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2018-11-04 00:00:00.000000000 Z
11
+ date: 2018-11-08 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: fluentd
@@ -30,14 +30,14 @@ dependencies:
30
30
  requirements:
31
31
  - - ">="
32
32
  - !ruby/object:Gem::Version
33
- version: '0'
33
+ version: 0.1.2
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - ">="
39
39
  - !ruby/object:Gem::Version
40
- version: '0'
40
+ version: 0.1.2
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: bundler
43
43
  requirement: !ruby/object:Gem::Requirement
@@ -142,9 +142,7 @@ files:
142
142
  - fluent-plugin-filter-parse-audit-log.gemspec
143
143
  - gemfiles/.bundle/config
144
144
  - gemfiles/fluentd_0.12.gemfile
145
- - gemfiles/fluentd_0.12.gemfile.lock
146
145
  - gemfiles/fluentd_0.14.gemfile
147
- - gemfiles/fluentd_0.14.gemfile.lock
148
146
  - lib/fluent/plugin/filter_parse_audit_log.rb
149
147
  - lib/fluent_plugin_filter_parse_audit_log/version.rb
150
148
  homepage: https://github.com/winebarrel/fluent-plugin-filter-parse-audit-log
data/gemfiles/fluentd_0.12.gemfile.lock DELETED
@@ -1,73 +0,0 @@
1
- PATH
2
- remote: ..
3
- specs:
4
- fluent-plugin-filter-parse-audit-log (0.1.0)
5
- audit_log_parser
6
- fluentd
7
-
8
- GEM
9
- remote: https://rubygems.org/
10
- specs:
11
- appraisal (2.2.0)
12
- bundler
13
- rake
14
- thor (>= 0.14.0)
15
- audit_log_parser (0.1.1)
16
- cool.io (1.5.3)
17
- diff-lcs (1.3)
18
- fluentd (0.12.43)
19
- cool.io (>= 1.2.2, < 2.0.0)
20
- http_parser.rb (>= 0.5.1, < 0.7.0)
21
- json (>= 1.4.3)
22
- msgpack (>= 0.5.11, < 2)
23
- sigdump (~> 0.2.2)
24
- string-scrub (>= 0.0.3, <= 0.0.5)
25
- tzinfo (>= 1.0.0)
26
- tzinfo-data (>= 1.0.0)
27
- yajl-ruby (~> 1.0)
28
- http_parser.rb (0.6.0)
29
- json (2.1.0)
30
- msgpack (1.2.4)
31
- power_assert (1.1.3)
32
- rake (12.3.1)
33
- rspec (3.8.0)
34
- rspec-core (~> 3.8.0)
35
- rspec-expectations (~> 3.8.0)
36
- rspec-mocks (~> 3.8.0)
37
- rspec-core (3.8.0)
38
- rspec-support (~> 3.8.0)
39
- rspec-expectations (3.8.2)
40
- diff-lcs (>= 1.2.0, < 2.0)
41
- rspec-support (~> 3.8.0)
42
- rspec-mocks (3.8.0)
43
- diff-lcs (>= 1.2.0, < 2.0)
44
- rspec-support (~> 3.8.0)
45
- rspec-support (3.8.0)
46
- sigdump (0.2.4)
47
- string-scrub (0.0.5)
48
- test-unit (3.2.8)
49
- power_assert
50
- thor (0.20.0)
51
- thread_safe (0.3.6)
52
- timecop (0.9.1)
53
- tzinfo (1.2.5)
54
- thread_safe (~> 0.1)
55
- tzinfo-data (1.2018.7)
56
- tzinfo (>= 1.0.0)
57
- yajl-ruby (1.4.1)
58
-
59
- PLATFORMS
60
- ruby
61
-
62
- DEPENDENCIES
63
- appraisal (>= 2.2)
64
- bundler
65
- fluent-plugin-filter-parse-audit-log!
66
- fluentd (>= 0.12, < 0.14)
67
- rake
68
- rspec (~> 3.0)
69
- test-unit (>= 3.1.0)
70
- timecop
71
-
72
- BUNDLED WITH
73
- 1.16.6
data/gemfiles/fluentd_0.14.gemfile.lock DELETED
@@ -1,76 +0,0 @@
1
- PATH
2
- remote: ..
3
- specs:
4
- fluent-plugin-filter-parse-audit-log (0.1.0)
5
- audit_log_parser
6
- fluentd
7
-
8
- GEM
9
- remote: https://rubygems.org/
10
- specs:
11
- appraisal (2.2.0)
12
- bundler
13
- rake
14
- thor (>= 0.14.0)
15
- audit_log_parser (0.1.1)
16
- cool.io (1.5.3)
17
- diff-lcs (1.3)
18
- dig_rb (1.0.1)
19
- fluentd (1.2.6)
20
- cool.io (>= 1.4.5, < 2.0.0)
21
- dig_rb (~> 1.0.0)
22
- http_parser.rb (>= 0.5.1, < 0.7.0)
23
- msgpack (>= 0.7.0, < 2.0.0)
24
- serverengine (>= 2.0.4, < 3.0.0)
25
- sigdump (~> 0.2.2)
26
- strptime (>= 0.2.2, < 1.0.0)
27
- tzinfo (~> 1.0)
28
- tzinfo-data (~> 1.0)
29
- yajl-ruby (~> 1.0)
30
- http_parser.rb (0.6.0)
31
- msgpack (1.2.4)
32
- power_assert (1.1.3)
33
- rake (12.3.1)
34
- rspec (3.8.0)
35
- rspec-core (~> 3.8.0)
36
- rspec-expectations (~> 3.8.0)
37
- rspec-mocks (~> 3.8.0)
38
- rspec-core (3.8.0)
39
- rspec-support (~> 3.8.0)
40
- rspec-expectations (3.8.2)
41
- diff-lcs (>= 1.2.0, < 2.0)
42
- rspec-support (~> 3.8.0)
43
- rspec-mocks (3.8.0)
44
- diff-lcs (>= 1.2.0, < 2.0)
45
- rspec-support (~> 3.8.0)
46
- rspec-support (3.8.0)
47
- serverengine (2.0.7)
48
- sigdump (~> 0.2.2)
49
- sigdump (0.2.4)
50
- strptime (0.2.3)
51
- test-unit (3.2.8)
52
- power_assert
53
- thor (0.20.0)
54
- thread_safe (0.3.6)
55
- timecop (0.9.1)
56
- tzinfo (1.2.5)
57
- thread_safe (~> 0.1)
58
- tzinfo-data (1.2018.7)
59
- tzinfo (>= 1.0.0)
60
- yajl-ruby (1.4.1)
61
-
62
- PLATFORMS
63
- ruby
64
-
65
- DEPENDENCIES
66
- appraisal (>= 2.2)
67
- bundler
68
- fluent-plugin-filter-parse-audit-log!
69
- fluentd (>= 0.14)
70
- rake
71
- rspec (~> 3.0)
72
- test-unit (>= 3.1.0)
73
- timecop
74
-
75
- BUNDLED WITH
76
- 1.16.6