fluent-plugin-osquery 0.0.2 → 0.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +5 -5
- data/fluent-plugin-osquery.gemspec +2 -2
- data/lib/fluent/plugin/in_osquery.rb +16 -38
- data/spec/fluent/plugin/in_osquery_spec.rb +3 -3
- data/spec/spec_helper.rb +1 -0
- metadata +5 -5
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
|
-
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 5555cc0776a704e38f7cefb6d41b40a68200795f
|
4
|
+
data.tar.gz: 6a95bf4f9a44193ff5bf7623845b5661acce29e7
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 7e5e3193482dbfdd519fbb99e128085ee230e24f6986a090c6ccfda02975234263c348ec035b00342be931a2b29f89d7bba6228b6097cbb09742bd364a77f18b
|
7
|
+
data.tar.gz: 1f45c004c7f86043990cc631fa1d09706884effed8e0964228d041fa283ad55c19c08a32d0054fd4d2178257c33db03a7b3a1b8fa9427c53f331824d7d0d8bb9
|
@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
4
|
|
5
5
|
Gem::Specification.new do |spec|
|
6
6
|
spec.name = 'fluent-plugin-osquery'
|
7
|
-
spec.version = '0.0.
|
7
|
+
spec.version = '0.0.3'
|
8
8
|
spec.authors = ['Hidenori Suzuki']
|
9
9
|
spec.email = ['hidenori.suzuki@yahoo.com']
|
10
10
|
spec.summary = 'a fluent plugin'
|
@@ -17,7 +17,7 @@ Gem::Specification.new do |spec|
|
|
17
17
|
spec.test_files = spec.files.grep(/^(test|spec|features)\//)
|
18
18
|
spec.require_paths = ['lib']
|
19
19
|
|
20
|
-
spec.add_runtime_dependency 'fluentd', '~> 1.2.
|
20
|
+
spec.add_runtime_dependency 'fluentd', '~> 1.2.0'
|
21
21
|
|
22
22
|
spec.add_development_dependency 'bundler'
|
23
23
|
spec.add_development_dependency 'rake'
|
@@ -1,8 +1,13 @@
|
|
1
1
|
# coding: utf-8
|
2
|
-
require '
|
3
|
-
|
4
|
-
|
2
|
+
require 'json'
|
3
|
+
require 'fluent/plugin/input'
|
4
|
+
|
5
|
+
module Fluent::Plugin
|
6
|
+
class OsqueryInput < Fluent::Plugin::Input
|
5
7
|
Fluent::Plugin.register_input('osquery', self)
|
8
|
+
|
9
|
+
helpers :timer
|
10
|
+
|
6
11
|
config_param :tag, :string, default: 'osquery'
|
7
12
|
config_param :interval, :integer, default: 60
|
8
13
|
config_param :query, :string, default: 'select * from processes'
|
@@ -13,7 +18,6 @@ module Fluent
|
|
13
18
|
|
14
19
|
def initialize
|
15
20
|
super
|
16
|
-
require 'json'
|
17
21
|
end
|
18
22
|
|
19
23
|
def configure(conf)
|
@@ -21,55 +25,29 @@ module Fluent
|
|
21
25
|
end
|
22
26
|
|
23
27
|
def start
|
24
|
-
|
25
|
-
|
26
|
-
@tw.attach(@loop)
|
27
|
-
@thread = Thread.new(&method(:run))
|
28
|
+
super
|
29
|
+
timer_execute(:in_osquery_timer, interval, &method(:execute))
|
28
30
|
end
|
29
31
|
|
30
32
|
def shutdown
|
31
|
-
|
32
|
-
@loop.stop
|
33
|
-
@thread.join
|
34
|
-
end
|
35
|
-
|
36
|
-
def run
|
37
|
-
@loop.run
|
38
|
-
rescue => e
|
39
|
-
@log.error 'unexpected error', error: e.to_s
|
40
|
-
@log.error_backtrace
|
33
|
+
super
|
41
34
|
end
|
42
35
|
|
43
36
|
private
|
44
37
|
|
45
38
|
def execute
|
46
|
-
@time = Engine.now
|
39
|
+
@time = Fluent::Engine.now
|
47
40
|
cmd = "osqueryi --json \"#{@query}\""
|
48
|
-
|
41
|
+
log.debug(cmd)
|
49
42
|
record = `#{cmd}`
|
50
43
|
jsonrec = JSON.parse(record)
|
51
44
|
jsonrec.each do |line|
|
52
|
-
|
45
|
+
log.debug(line)
|
53
46
|
router.emit(@tag, @time, line)
|
54
47
|
end
|
55
48
|
rescue => e
|
56
|
-
|
57
|
-
|
58
|
-
end
|
59
|
-
|
60
|
-
class TimerWatcher < Coolio::TimerWatcher
|
61
|
-
def initialize(interval, repeat, log, &callback)
|
62
|
-
@log = log
|
63
|
-
@callback = callback
|
64
|
-
super(interval, repeat)
|
65
|
-
end
|
66
|
-
|
67
|
-
def on_timer
|
68
|
-
@callback.call
|
69
|
-
rescue => e
|
70
|
-
@log.error e.to_s
|
71
|
-
@log.error_backtrace
|
72
|
-
end
|
49
|
+
log.error('faild to run', error: e.to_s, error_class: e.class.to_s)
|
50
|
+
log.error_backtrace
|
73
51
|
end
|
74
52
|
end
|
75
53
|
end
|
@@ -8,14 +8,14 @@ CONFIG = BASE_CONFIG + %(
|
|
8
8
|
interval 1
|
9
9
|
)
|
10
10
|
|
11
|
-
describe Fluent::OsqueryInput do
|
11
|
+
describe Fluent::Plugin::OsqueryInput do
|
12
12
|
before do
|
13
13
|
Fluent::Test.setup
|
14
14
|
end
|
15
15
|
|
16
16
|
describe '#configure' do
|
17
17
|
let(:d) do
|
18
|
-
Fluent::Test::
|
18
|
+
Fluent::Test::Driver::Input.new(Fluent::Plugin::OsqueryInput)
|
19
19
|
end
|
20
20
|
|
21
21
|
context 'test of test' do
|
@@ -29,7 +29,7 @@ describe Fluent::OsqueryInput do
|
|
29
29
|
|
30
30
|
describe '#run' do
|
31
31
|
let(:d) do
|
32
|
-
Fluent::Test::
|
32
|
+
Fluent::Test::Driver::Input.new(Fluent::Plugin::OsqueryInput)
|
33
33
|
.configure(config)
|
34
34
|
end
|
35
35
|
|
data/spec/spec_helper.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-osquery
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Hidenori Suzuki
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2018-10-
|
11
|
+
date: 2018-10-23 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: fluentd
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - "~>"
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 1.2.
|
19
|
+
version: 1.2.0
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 1.2.
|
26
|
+
version: 1.2.0
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: bundler
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -117,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
117
117
|
version: '0'
|
118
118
|
requirements: []
|
119
119
|
rubyforge_project:
|
120
|
-
rubygems_version: 2.
|
120
|
+
rubygems_version: 2.6.14.1
|
121
121
|
signing_key:
|
122
122
|
specification_version: 4
|
123
123
|
summary: a fluent plugin
|