fluent-plugin-filter-parse-audit-log 0.1.0 → 0.1.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +1 -0
  3. data/README.md +38 -3
  4. data/fluent-plugin-filter-parse-audit-log.gemspec +1 -1
  5. data/lib/fluent/plugin/filter_parse_audit_log.rb +3 -2
  6. data/lib/fluent_plugin_filter_parse_audit_log/version.rb +1 -1
  7. metadata +4 -6
  8. data/gemfiles/fluentd_0.12.gemfile.lock +0 -73
  9. data/gemfiles/fluentd_0.14.gemfile.lock +0 -76
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 1dab94129a17f2aeb9eda08c28c95de6c73e0e1fd1953069d9795dba32acbdf2
4
- data.tar.gz: e4299fb0a3102f98c6efdd39eee9c0a7f37aa0e37d49f811a5097a3920c7aa5d
3
+ metadata.gz: 800c1ba3742e0a1fd76864255646610a48f32a4594ddf547731c0450e34f0a21
4
+ data.tar.gz: 4bc4de38894afb85a510df790072c5f396e15a2be69f8733c10d5d61ea44e013
5
5
  SHA512:
6
- metadata.gz: 5d794eb895d4335d50aa32ce84d2f35b562f1f8d65890c44984f266bbc9b46bcb917e21a11a8a38df3680aa518201ef4ddc52f2e1638ed4e4181d33f94945576
7
- data.tar.gz: e72d244dfc839cb54ee3d0e7ec12c4ba19b1f662af26d48558bc55a8b408fc7bd780e71fbabdda30d05dcf5881b7ce8115ae340818ff43e651b94dd99a8aa9a9
6
+ metadata.gz: f7c633fc97e6abb3c58be509aac6c7bf23aa94518650ba5716d01464827ca9932c32883ac8486a2e8c2510fd1c4df13093173806e8cd5a22b96b0a4d9393af52
7
+ data.tar.gz: 9b2a158848040d424b36fec749eed6e10d718293f9ab651b56c37acb167195e60ef48fe950df754da93922465fafd1641fa9fa89777ac72ee4a50c2469a44300
data/.gitignore CHANGED
@@ -8,6 +8,7 @@
8
8
  /tmp/
9
9
  Gemfile.lock
10
10
  /test/
11
+ /gemfiles/*.lock
11
12
 
12
13
  # rspec failure tracking
13
14
  .rspec_status
data/README.md CHANGED
@@ -26,9 +26,10 @@ Or install it yourself as:
26
26
  ```
27
27
  @type parse_audit_log
28
28
  #key message
29
+ #flatten false
29
30
  ```
30
31
 
31
- ## Example
32
+ ## Output
32
33
 
33
34
  ```
34
35
  <source>
@@ -45,11 +46,45 @@ Or install it yourself as:
45
46
  ```
46
47
 
47
48
  ```sh
48
- echo '{"message":"type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm=\"cat\" exe=\"/bin/cat\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"sshd_config\""}' | fluent-cat -t audit.log
49
+ echo '{"message":"type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm=\"cat\" exe=\"/bin/cat\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"sshd_config\""}' \
50
+ | fluent-cat -t audit.log
49
51
  ```
50
52
 
51
53
  ```json
52
- 2018-11-04 11:48:05.000000000 +0900 audit.log: {"header":{"type":"SYSCALL","msg":"audit(1364481363.243:24287)"},"body":{"arch":"c000003e","syscall":"2","success":"no","exit":"-13","a0":"7fffd19c5592","a1":"0","a2":"7fffd19c4b50","a3":"a","items":"1","ppid":"2686","pid":"3538","auid":"500","uid":"500","gid":"500","euid":"500","suid":"500","fsuid":"500","egid":"500","sgid":"500","fsgid":"500","tty":"pts0","ses":"1","comm":"\"cat\"","exe":"\"/bin/cat\"","subj":"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023","key":"\"sshd_config\""}}
54
+ {
55
+ "header": {
56
+ "type": "SYSCALL",
57
+ "msg": "audit(1364481363.243:24287)"
58
+ },
59
+ "body": {
60
+ "arch": "c000003e",
61
+ "syscall": "2",
62
+ "success": "no",
63
+ "exit": "-13",
64
+ "a0": "7fffd19c5592",
65
+ "a1": "0",
66
+ "a2": "7fffd19c4b50",
67
+ "a3": "a",
68
+ "items": "1",
69
+ "ppid": "2686",
70
+ "pid": "3538",
71
+ "auid": "500",
72
+ "uid": "500",
73
+ "gid": "500",
74
+ "euid": "500",
75
+ "suid": "500",
76
+ "fsuid": "500",
77
+ "egid": "500",
78
+ "sgid": "500",
79
+ "fsgid": "500",
80
+ "tty": "pts0",
81
+ "ses": "1",
82
+ "comm": "\"cat\"",
83
+ "exe": "\"/bin/cat\"",
84
+ "subj": "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023",
85
+ "key": "\"sshd_config\""
86
+ }
87
+ }
53
88
  ```
54
89
 
55
90
  ## Related Links
data/fluent-plugin-filter-parse-audit-log.gemspec CHANGED
@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
23
23
  spec.require_paths = ['lib']
24
24
 
25
25
  spec.add_dependency 'fluentd'
26
- spec.add_dependency 'audit_log_parser'
26
+ spec.add_dependency 'audit_log_parser', '>= 0.1.2'
27
27
  spec.add_development_dependency 'bundler'
28
28
  spec.add_development_dependency 'rake'
29
29
  spec.add_development_dependency 'rspec', '~> 3.0'
data/lib/fluent/plugin/filter_parse_audit_log.rb CHANGED
@@ -4,12 +4,13 @@ require 'audit_log_parser'
4
4
  class FluentParseAuditLogFilter < Fluent::Filter
5
5
  Fluent::Plugin.register_filter('parse_audit_log', self)
6
6
 
7
- config_param :key, :string, :default => 'message'
7
+ config_param :key, :string, default: 'message'
8
+ config_param :flatten, :bool, default: false
8
9
 
9
10
  def filter(tag, time, record)
10
11
  line = record[@key]
11
12
  return record unless line
12
- AuditLogParser.parse_line(line)
13
+ AuditLogParser.parse_line(line, flatten: @flatten)
13
14
  rescue => e
14
15
  log.warn "failed to parse a audit log: #{line}", error_class: e.class, error: e.message
15
16
  log.warn_backtrace
data/lib/fluent_plugin_filter_parse_audit_log/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module FluentPluginFilterParseAuditLog
2
- VERSION = '0.1.0'
2
+ VERSION = '0.1.1'
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: fluent-plugin-filter-parse-audit-log
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.0
4
+ version: 0.1.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - winebarrel
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2018-11-04 00:00:00.000000000 Z
11
+ date: 2018-11-08 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: fluentd
@@ -30,14 +30,14 @@ dependencies:
30
30
  requirements:
31
31
  - - ">="
32
32
  - !ruby/object:Gem::Version
33
- version: '0'
33
+ version: 0.1.2
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - ">="
39
39
  - !ruby/object:Gem::Version
40
- version: '0'
40
+ version: 0.1.2
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: bundler
43
43
  requirement: !ruby/object:Gem::Requirement
@@ -142,9 +142,7 @@ files:
142
142
  - fluent-plugin-filter-parse-audit-log.gemspec
143
143
  - gemfiles/.bundle/config
144
144
  - gemfiles/fluentd_0.12.gemfile
145
- - gemfiles/fluentd_0.12.gemfile.lock
146
145
  - gemfiles/fluentd_0.14.gemfile
147
- - gemfiles/fluentd_0.14.gemfile.lock
148
146
  - lib/fluent/plugin/filter_parse_audit_log.rb
149
147
  - lib/fluent_plugin_filter_parse_audit_log/version.rb
150
148
  homepage: https://github.com/winebarrel/fluent-plugin-filter-parse-audit-log
data/gemfiles/fluentd_0.12.gemfile.lock DELETED
@@ -1,73 +0,0 @@
1
- PATH
2
- remote: ..
3
- specs:
4
- fluent-plugin-filter-parse-audit-log (0.1.0)
5
- audit_log_parser
6
- fluentd
7
-
8
- GEM
9
- remote: https://rubygems.org/
10
- specs:
11
- appraisal (2.2.0)
12
- bundler
13
- rake
14
- thor (>= 0.14.0)
15
- audit_log_parser (0.1.1)
16
- cool.io (1.5.3)
17
- diff-lcs (1.3)
18
- fluentd (0.12.43)
19
- cool.io (>= 1.2.2, < 2.0.0)
20
- http_parser.rb (>= 0.5.1, < 0.7.0)
21
- json (>= 1.4.3)
22
- msgpack (>= 0.5.11, < 2)
23
- sigdump (~> 0.2.2)
24
- string-scrub (>= 0.0.3, <= 0.0.5)
25
- tzinfo (>= 1.0.0)
26
- tzinfo-data (>= 1.0.0)
27
- yajl-ruby (~> 1.0)
28
- http_parser.rb (0.6.0)
29
- json (2.1.0)
30
- msgpack (1.2.4)
31
- power_assert (1.1.3)
32
- rake (12.3.1)
33
- rspec (3.8.0)
34
- rspec-core (~> 3.8.0)
35
- rspec-expectations (~> 3.8.0)
36
- rspec-mocks (~> 3.8.0)
37
- rspec-core (3.8.0)
38
- rspec-support (~> 3.8.0)
39
- rspec-expectations (3.8.2)
40
- diff-lcs (>= 1.2.0, < 2.0)
41
- rspec-support (~> 3.8.0)
42
- rspec-mocks (3.8.0)
43
- diff-lcs (>= 1.2.0, < 2.0)
44
- rspec-support (~> 3.8.0)
45
- rspec-support (3.8.0)
46
- sigdump (0.2.4)
47
- string-scrub (0.0.5)
48
- test-unit (3.2.8)
49
- power_assert
50
- thor (0.20.0)
51
- thread_safe (0.3.6)
52
- timecop (0.9.1)
53
- tzinfo (1.2.5)
54
- thread_safe (~> 0.1)
55
- tzinfo-data (1.2018.7)
56
- tzinfo (>= 1.0.0)
57
- yajl-ruby (1.4.1)
58
-
59
- PLATFORMS
60
- ruby
61
-
62
- DEPENDENCIES
63
- appraisal (>= 2.2)
64
- bundler
65
- fluent-plugin-filter-parse-audit-log!
66
- fluentd (>= 0.12, < 0.14)
67
- rake
68
- rspec (~> 3.0)
69
- test-unit (>= 3.1.0)
70
- timecop
71
-
72
- BUNDLED WITH
73
- 1.16.6
data/gemfiles/fluentd_0.14.gemfile.lock DELETED
@@ -1,76 +0,0 @@
1
- PATH
2
- remote: ..
3
- specs:
4
- fluent-plugin-filter-parse-audit-log (0.1.0)
5
- audit_log_parser
6
- fluentd
7
-
8
- GEM
9
- remote: https://rubygems.org/
10
- specs:
11
- appraisal (2.2.0)
12
- bundler
13
- rake
14
- thor (>= 0.14.0)
15
- audit_log_parser (0.1.1)
16
- cool.io (1.5.3)
17
- diff-lcs (1.3)
18
- dig_rb (1.0.1)
19
- fluentd (1.2.6)
20
- cool.io (>= 1.4.5, < 2.0.0)
21
- dig_rb (~> 1.0.0)
22
- http_parser.rb (>= 0.5.1, < 0.7.0)
23
- msgpack (>= 0.7.0, < 2.0.0)
24
- serverengine (>= 2.0.4, < 3.0.0)
25
- sigdump (~> 0.2.2)
26
- strptime (>= 0.2.2, < 1.0.0)
27
- tzinfo (~> 1.0)
28
- tzinfo-data (~> 1.0)
29
- yajl-ruby (~> 1.0)
30
- http_parser.rb (0.6.0)
31
- msgpack (1.2.4)
32
- power_assert (1.1.3)
33
- rake (12.3.1)
34
- rspec (3.8.0)
35
- rspec-core (~> 3.8.0)
36
- rspec-expectations (~> 3.8.0)
37
- rspec-mocks (~> 3.8.0)
38
- rspec-core (3.8.0)
39
- rspec-support (~> 3.8.0)
40
- rspec-expectations (3.8.2)
41
- diff-lcs (>= 1.2.0, < 2.0)
42
- rspec-support (~> 3.8.0)
43
- rspec-mocks (3.8.0)
44
- diff-lcs (>= 1.2.0, < 2.0)
45
- rspec-support (~> 3.8.0)
46
- rspec-support (3.8.0)
47
- serverengine (2.0.7)
48
- sigdump (~> 0.2.2)
49
- sigdump (0.2.4)
50
- strptime (0.2.3)
51
- test-unit (3.2.8)
52
- power_assert
53
- thor (0.20.0)
54
- thread_safe (0.3.6)
55
- timecop (0.9.1)
56
- tzinfo (1.2.5)
57
- thread_safe (~> 0.1)
58
- tzinfo-data (1.2018.7)
59
- tzinfo (>= 1.0.0)
60
- yajl-ruby (1.4.1)
61
-
62
- PLATFORMS
63
- ruby
64
-
65
- DEPENDENCIES
66
- appraisal (>= 2.2)
67
- bundler
68
- fluent-plugin-filter-parse-audit-log!
69
- fluentd (>= 0.14)
70
- rake
71
- rspec (~> 3.0)
72
- test-unit (>= 3.1.0)
73
- timecop
74
-
75
- BUNDLED WITH
76
- 1.16.6