fluent-plugin-osquery 0.0.2 → 0.0.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/fluent-plugin-osquery.gemspec +2 -2
- data/lib/fluent/plugin/in_osquery.rb +16 -38
- data/spec/fluent/plugin/in_osquery_spec.rb +3 -3
- data/spec/spec_helper.rb +1 -0
- metadata +5 -5
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
|
-
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 5555cc0776a704e38f7cefb6d41b40a68200795f
|
4
|
+
data.tar.gz: 6a95bf4f9a44193ff5bf7623845b5661acce29e7
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 7e5e3193482dbfdd519fbb99e128085ee230e24f6986a090c6ccfda02975234263c348ec035b00342be931a2b29f89d7bba6228b6097cbb09742bd364a77f18b
|
7
|
+
data.tar.gz: 1f45c004c7f86043990cc631fa1d09706884effed8e0964228d041fa283ad55c19c08a32d0054fd4d2178257c33db03a7b3a1b8fa9427c53f331824d7d0d8bb9
|
@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
4
|
|
5
5
|
Gem::Specification.new do |spec|
|
6
6
|
spec.name = 'fluent-plugin-osquery'
|
7
|
-
spec.version = '0.0.
|
7
|
+
spec.version = '0.0.3'
|
8
8
|
spec.authors = ['Hidenori Suzuki']
|
9
9
|
spec.email = ['hidenori.suzuki@yahoo.com']
|
10
10
|
spec.summary = 'a fluent plugin'
|
@@ -17,7 +17,7 @@ Gem::Specification.new do |spec|
|
|
17
17
|
spec.test_files = spec.files.grep(/^(test|spec|features)\//)
|
18
18
|
spec.require_paths = ['lib']
|
19
19
|
|
20
|
-
spec.add_runtime_dependency 'fluentd', '~> 1.2.
|
20
|
+
spec.add_runtime_dependency 'fluentd', '~> 1.2.0'
|
21
21
|
|
22
22
|
spec.add_development_dependency 'bundler'
|
23
23
|
spec.add_development_dependency 'rake'
|
@@ -1,8 +1,13 @@
|
|
1
1
|
# coding: utf-8
|
2
|
-
require '
|
3
|
-
|
4
|
-
|
2
|
+
require 'json'
|
3
|
+
require 'fluent/plugin/input'
|
4
|
+
|
5
|
+
module Fluent::Plugin
|
6
|
+
class OsqueryInput < Fluent::Plugin::Input
|
5
7
|
Fluent::Plugin.register_input('osquery', self)
|
8
|
+
|
9
|
+
helpers :timer
|
10
|
+
|
6
11
|
config_param :tag, :string, default: 'osquery'
|
7
12
|
config_param :interval, :integer, default: 60
|
8
13
|
config_param :query, :string, default: 'select * from processes'
|
@@ -13,7 +18,6 @@ module Fluent
|
|
13
18
|
|
14
19
|
def initialize
|
15
20
|
super
|
16
|
-
require 'json'
|
17
21
|
end
|
18
22
|
|
19
23
|
def configure(conf)
|
@@ -21,55 +25,29 @@ module Fluent
|
|
21
25
|
end
|
22
26
|
|
23
27
|
def start
|
24
|
-
|
25
|
-
|
26
|
-
@tw.attach(@loop)
|
27
|
-
@thread = Thread.new(&method(:run))
|
28
|
+
super
|
29
|
+
timer_execute(:in_osquery_timer, interval, &method(:execute))
|
28
30
|
end
|
29
31
|
|
30
32
|
def shutdown
|
31
|
-
|
32
|
-
@loop.stop
|
33
|
-
@thread.join
|
34
|
-
end
|
35
|
-
|
36
|
-
def run
|
37
|
-
@loop.run
|
38
|
-
rescue => e
|
39
|
-
@log.error 'unexpected error', error: e.to_s
|
40
|
-
@log.error_backtrace
|
33
|
+
super
|
41
34
|
end
|
42
35
|
|
43
36
|
private
|
44
37
|
|
45
38
|
def execute
|
46
|
-
@time = Engine.now
|
39
|
+
@time = Fluent::Engine.now
|
47
40
|
cmd = "osqueryi --json \"#{@query}\""
|
48
|
-
|
41
|
+
log.debug(cmd)
|
49
42
|
record = `#{cmd}`
|
50
43
|
jsonrec = JSON.parse(record)
|
51
44
|
jsonrec.each do |line|
|
52
|
-
|
45
|
+
log.debug(line)
|
53
46
|
router.emit(@tag, @time, line)
|
54
47
|
end
|
55
48
|
rescue => e
|
56
|
-
|
57
|
-
|
58
|
-
end
|
59
|
-
|
60
|
-
class TimerWatcher < Coolio::TimerWatcher
|
61
|
-
def initialize(interval, repeat, log, &callback)
|
62
|
-
@log = log
|
63
|
-
@callback = callback
|
64
|
-
super(interval, repeat)
|
65
|
-
end
|
66
|
-
|
67
|
-
def on_timer
|
68
|
-
@callback.call
|
69
|
-
rescue => e
|
70
|
-
@log.error e.to_s
|
71
|
-
@log.error_backtrace
|
72
|
-
end
|
49
|
+
log.error('faild to run', error: e.to_s, error_class: e.class.to_s)
|
50
|
+
log.error_backtrace
|
73
51
|
end
|
74
52
|
end
|
75
53
|
end
|
@@ -8,14 +8,14 @@ CONFIG = BASE_CONFIG + %(
|
|
8
8
|
interval 1
|
9
9
|
)
|
10
10
|
|
11
|
-
describe Fluent::OsqueryInput do
|
11
|
+
describe Fluent::Plugin::OsqueryInput do
|
12
12
|
before do
|
13
13
|
Fluent::Test.setup
|
14
14
|
end
|
15
15
|
|
16
16
|
describe '#configure' do
|
17
17
|
let(:d) do
|
18
|
-
Fluent::Test::
|
18
|
+
Fluent::Test::Driver::Input.new(Fluent::Plugin::OsqueryInput)
|
19
19
|
end
|
20
20
|
|
21
21
|
context 'test of test' do
|
@@ -29,7 +29,7 @@ describe Fluent::OsqueryInput do
|
|
29
29
|
|
30
30
|
describe '#run' do
|
31
31
|
let(:d) do
|
32
|
-
Fluent::Test::
|
32
|
+
Fluent::Test::Driver::Input.new(Fluent::Plugin::OsqueryInput)
|
33
33
|
.configure(config)
|
34
34
|
end
|
35
35
|
|
data/spec/spec_helper.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-osquery
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Hidenori Suzuki
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2018-10-
|
11
|
+
date: 2018-10-23 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: fluentd
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - "~>"
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 1.2.
|
19
|
+
version: 1.2.0
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 1.2.
|
26
|
+
version: 1.2.0
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: bundler
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -117,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
117
117
|
version: '0'
|
118
118
|
requirements: []
|
119
119
|
rubyforge_project:
|
120
|
-
rubygems_version: 2.
|
120
|
+
rubygems_version: 2.6.14.1
|
121
121
|
signing_key:
|
122
122
|
specification_version: 4
|
123
123
|
summary: a fluent plugin
|