fluent-plugin-syscheck 0.2.0 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +15 -1
  3. data/README.md +27 -1
  4. data/lib/fluent/plugin/in_syscheck_mounts.rb +2 -5
  5. data/lib/fluent/plugin/in_syscheck_sockets.rb +110 -0
  6. metadata +66 -39
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 1fc9cd18d52c75a1db0b29d655b74a9b4830b66aab86b3e04d291cf2f1555261
4
- data.tar.gz: 46d2984fdbe048eda60e01787cb2e7cddbc1e5a7589e1cb1223d35b327d40538
3
+ metadata.gz: 92ac9cfe44fd3294e35917b50019c3abfe2ed62ecb994283adfc3efda91278d3
4
+ data.tar.gz: e52223b23229ac4af7f66a679cfb08113b4b3181ed8f272dc3d84a957ca392d2
5
5
  SHA512:
6
- metadata.gz: b42c43682f9af8cff35d02fb7684065c8fbdcf73834504f0c266b798147eccdf56c3071149987f8482447c023a95de1d04e22860f79052cd091c2c5f54344da8
7
- data.tar.gz: f8407c1f94804b6fa23949f72412d96ad3fe57dbb1eaaaccd6fd522aaeb5d0c6653778b371fc8a691fb88ed6cebc4871145a002b4cda3fd65d861e120482dba9
6
+ metadata.gz: ee880aafdd61891c8100022bbc6ec5c02da2ccdf96a7b6f89fa0726f387eabb91fd2fa36fdafd8f7fdd1091f17c15bdee08bb05380ab6bbd5dfbced8b91ed652
7
+ data.tar.gz: 3ad6cb9c9c0f83cc55df6cb5150998ea974e6106bd7281e54d8cfc778ee908aad5237ed75186653a0114a49d65ec664c38ab9315a27671d6a14e6dd8800c9ff1
data/.rubocop.yml CHANGED
@@ -4,12 +4,20 @@ plugins:
4
4
  - rubocop-rake
5
5
 
6
6
  AllCops:
7
- TargetRubyVersion: 3.1
7
+ TargetRubyVersion: 3.2
8
8
  NewCops: enable
9
9
 
10
10
  Gemspec/DevelopmentDependencies:
11
11
  EnforcedStyle: gemspec
12
12
 
13
+ Layout/LineLength:
14
+ Max: 120
15
+
16
+ Metrics/AbcSize:
17
+ Max: 25
18
+ Exclude:
19
+ - 'test/**/test*.rb'
20
+
13
21
  Metrics/BlockLength:
14
22
  Exclude:
15
23
  - fluent-plugin-syscheck.gemspec
@@ -19,6 +27,12 @@ Metrics/ClassLength:
19
27
  Exclude:
20
28
  - test/**/*.rb
21
29
 
30
+ Metrics/MethodLength:
31
+ Max: 20
32
+
33
+ Metrics/ParameterLists:
34
+ Max: 12
35
+
22
36
  Style/Documentation:
23
37
  Enabled: false
24
38
 
data/README.md CHANGED
@@ -56,8 +56,34 @@ Parameters are:
56
56
  </source>
57
57
  ```
58
58
 
59
+ ## plugin : syscheck_sockets
60
+
61
+ ### configuration
62
+
63
+ Parameters are:
64
+
65
+ | parameter | type | purpose |
66
+ |-------------------------|--------|----------------------------------------------|
67
+ | tag | string | tag to emit event on |
68
+ | interval | time | interval to exec mount check |
69
+ | first_run_wait_interval | bool | first collect wait interval before execution |
70
+ | list_sockets | bool | dump sockets information |
71
+
72
+ ### examples
73
+
74
+ ``` text
75
+ <source>
76
+ @type syscheck_sockets
77
+
78
+ tag test
79
+ interval 60
80
+ first_run_wait_interval false
81
+ list_sockets true
82
+ </source>
83
+ ```
84
+
59
85
  ## Copyright
60
86
 
61
- * Copyright(c) 2025- Thomas Tych
87
+ * Copyright(c) 2025-2026 Thomas Tych
62
88
  * License
63
89
  * Apache License, Version 2.0
data/lib/fluent/plugin/in_syscheck_mounts.rb CHANGED
@@ -17,7 +17,7 @@
17
17
 
18
18
  require 'fluent/plugin/input'
19
19
 
20
- # rubocop:disable Metrics/AbcSize, Metrics/ClassLength, Metrics/MethodLength
20
+ # rubocop:disable-next Metrics/ClassLength, Metrics/MethodLength
21
21
  module Fluent
22
22
  module Plugin
23
23
  class SyscheckMountsInput < Fluent::Plugin::Input
@@ -80,9 +80,7 @@ module Fluent
80
80
  def configure(conf)
81
81
  super
82
82
 
83
- raise Fluent::ConfigError, 'tag should not be empty' if tag.empty?
84
-
85
- true
83
+ raise Fluent::ConfigError, 'tag should not be empty' if tag.nil? || tag.empty?
86
84
  end
87
85
 
88
86
  def start
@@ -222,4 +220,3 @@ module Fluent
222
220
  end
223
221
  end
224
222
  end
225
- # rubocop:enable Metrics/AbcSize, Metrics/ClassLength, Metrics/MethodLength
data/lib/fluent/plugin/in_syscheck_sockets.rb ADDED
@@ -0,0 +1,110 @@
1
+ # frozen_string_literal: true
2
+
3
+ #
4
+ # Copyright 2026- Thomas Tych
5
+ #
6
+ # Licensed under the Apache License, Version 2.0 (the "License");
7
+ # you may not use this file except in compliance with the License.
8
+ # You may obtain a copy of the License at
9
+ #
10
+ # http://www.apache.org/licenses/LICENSE-2.0
11
+ #
12
+ # Unless required by applicable law or agreed to in writing, software
13
+ # distributed under the License is distributed on an "AS IS" BASIS,
14
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15
+ # See the License for the specific language governing permissions and
16
+ # limitations under the License.
17
+
18
+ require 'fluent/plugin/input'
19
+
20
+ require 'procfs_rb'
21
+ require 'procfs_rb/proc_fs/parser/net_tcp_parser'
22
+
23
+ module Fluent
24
+ module Plugin
25
+ class SyscheckSocketsInput < Fluent::Plugin::Input
26
+ NAME = 'syscheck_sockets'
27
+ Fluent::Plugin.register_input(NAME, self)
28
+
29
+ helpers :event_emitter, :timer
30
+
31
+ INTERVAL = 300
32
+
33
+ DEFAULT_LIST = false
34
+ DEFAULT_FIRST_RUN_WAIT_INTERVAL = true
35
+
36
+ desc 'The tag of the event is emitted on'
37
+ config_param :tag, :string
38
+ desc 'interval for probe execution'
39
+ config_param :interval, :time, default: INTERVAL
40
+ desc 'Wait interval for first execution'
41
+ config_param :first_run_wait_interval, :bool, default: DEFAULT_FIRST_RUN_WAIT_INTERVAL
42
+
43
+ desc 'List sockets'
44
+ config_param :list_sockets, :bool, default: DEFAULT_LIST
45
+
46
+ def configure(conf)
47
+ super
48
+
49
+ raise Fluent::ConfigError, 'tag should not be empty' if tag.nil? || tag.empty?
50
+ end
51
+
52
+ def start
53
+ super
54
+
55
+ timer_execute(:run_check_first, 1, repeat: false, &method(:run_check)) unless first_run_wait_interval
56
+ timer_execute(:run_check, interval, repeat: true, &method(:run_check))
57
+ end
58
+
59
+ def run_check
60
+ run_check_tcp4
61
+ run_check_tcp6
62
+ rescue StandardError => e
63
+ log.error "#{NAME}: error during check: #{e}"
64
+ end
65
+
66
+ def run_check_tcp4
67
+ tcp4_content = read_file_content('/proc/net/tcp')
68
+ return if tcp4_content.nil?
69
+
70
+ parser = ProcFS::Parser::NetTcpParser.ipv4
71
+ tcp4_info = parser.parse(tcp4_content)
72
+
73
+ emit_list_sockets(tcp4_info) if list_sockets
74
+ end
75
+
76
+ def run_check_tcp6
77
+ tcp6_content = read_file_content('/proc/net/tcp6')
78
+ return if tcp6_content.nil?
79
+
80
+ parser = ProcFS::Parser::NetTcpParser.ipv6
81
+ tcp6_info = parser.parse(tcp6_content)
82
+
83
+ emit_list_sockets(tcp6_info) if list_sockets
84
+ end
85
+
86
+ def emit_list_sockets(sockets)
87
+ log.debug "#{NAME}: emit list_sockets"
88
+
89
+ event_time = Fluent::EventTime.from_time(sockets.timestamp)
90
+ sockets.each do |socket|
91
+ router.emit(
92
+ tag,
93
+ event_time,
94
+ socket.to_h
95
+ .transform_keys(&:to_s)
96
+ .merge('timestamp' => sockets.timestamp.iso8601(3))
97
+ )
98
+ end
99
+ end
100
+
101
+ private
102
+
103
+ def read_file_content(path)
104
+ File.read(path)
105
+ rescue Errno::ENOENT => e
106
+ log.error "#{NAME}: can't read \"#{path}\" content: #{e}"
107
+ end
108
+ end
109
+ end
110
+ end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: fluent-plugin-syscheck
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.2.0
4
+ version: 0.3.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Thomas Tych
@@ -29,128 +29,128 @@ dependencies:
29
29
  requirements:
30
30
  - - "~>"
31
31
  - !ruby/object:Gem::Version
32
- version: '2.5'
32
+ version: '4.0'
33
33
  - - ">="
34
34
  - !ruby/object:Gem::Version
35
- version: 2.5.9
35
+ version: 4.0.21
36
36
  type: :development
37
37
  prerelease: false
38
38
  version_requirements: !ruby/object:Gem::Requirement
39
39
  requirements:
40
40
  - - "~>"
41
41
  - !ruby/object:Gem::Version
42
- version: '2.5'
42
+ version: '4.0'
43
43
  - - ">="
44
44
  - !ruby/object:Gem::Version
45
- version: 2.5.9
45
+ version: 4.0.21
46
46
  - !ruby/object:Gem::Dependency
47
47
  name: byebug
48
48
  requirement: !ruby/object:Gem::Requirement
49
49
  requirements:
50
50
  - - "~>"
51
51
  - !ruby/object:Gem::Version
52
- version: '11.1'
53
- - - ">="
54
- - !ruby/object:Gem::Version
55
- version: 11.1.3
52
+ version: '13.0'
56
53
  type: :development
57
54
  prerelease: false
58
55
  version_requirements: !ruby/object:Gem::Requirement
59
56
  requirements:
60
57
  - - "~>"
61
58
  - !ruby/object:Gem::Version
62
- version: '11.1'
63
- - - ">="
64
- - !ruby/object:Gem::Version
65
- version: 11.1.3
59
+ version: '13.0'
66
60
  - !ruby/object:Gem::Dependency
67
61
  name: irb
68
62
  requirement: !ruby/object:Gem::Requirement
69
63
  requirements:
64
+ - - "~>"
65
+ - !ruby/object:Gem::Version
66
+ version: '1.18'
70
67
  - - ">="
71
68
  - !ruby/object:Gem::Version
72
- version: '0'
69
+ version: 1.18.0
73
70
  type: :development
74
71
  prerelease: false
75
72
  version_requirements: !ruby/object:Gem::Requirement
76
73
  requirements:
74
+ - - "~>"
75
+ - !ruby/object:Gem::Version
76
+ version: '1.18'
77
77
  - - ">="
78
78
  - !ruby/object:Gem::Version
79
- version: '0'
79
+ version: 1.18.0
80
80
  - !ruby/object:Gem::Dependency
81
81
  name: mocha
82
82
  requirement: !ruby/object:Gem::Requirement
83
83
  requirements:
84
84
  - - "~>"
85
85
  - !ruby/object:Gem::Version
86
- version: '2.7'
86
+ version: '3.1'
87
87
  - - ">="
88
88
  - !ruby/object:Gem::Version
89
- version: 2.7.1
89
+ version: 3.1.0
90
90
  type: :development
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
94
  - - "~>"
95
95
  - !ruby/object:Gem::Version
96
- version: '2.7'
96
+ version: '3.1'
97
97
  - - ">="
98
98
  - !ruby/object:Gem::Version
99
- version: 2.7.1
99
+ version: 3.1.0
100
100
  - !ruby/object:Gem::Dependency
101
101
  name: rake
102
102
  requirement: !ruby/object:Gem::Requirement
103
103
  requirements:
104
104
  - - "~>"
105
105
  - !ruby/object:Gem::Version
106
- version: '13.2'
106
+ version: '13.4'
107
107
  - - ">="
108
108
  - !ruby/object:Gem::Version
109
- version: 13.2.1
109
+ version: 13.4.2
110
110
  type: :development
111
111
  prerelease: false
112
112
  version_requirements: !ruby/object:Gem::Requirement
113
113
  requirements:
114
114
  - - "~>"
115
115
  - !ruby/object:Gem::Version
116
- version: '13.2'
116
+ version: '13.4'
117
117
  - - ">="
118
118
  - !ruby/object:Gem::Version
119
- version: 13.2.1
119
+ version: 13.4.2
120
120
  - !ruby/object:Gem::Dependency
121
121
  name: reek
122
122
  requirement: !ruby/object:Gem::Requirement
123
123
  requirements:
124
124
  - - "~>"
125
125
  - !ruby/object:Gem::Version
126
- version: '6.4'
126
+ version: '6.5'
127
127
  type: :development
128
128
  prerelease: false
129
129
  version_requirements: !ruby/object:Gem::Requirement
130
130
  requirements:
131
131
  - - "~>"
132
132
  - !ruby/object:Gem::Version
133
- version: '6.4'
133
+ version: '6.5'
134
134
  - !ruby/object:Gem::Dependency
135
135
  name: rubocop
136
136
  requirement: !ruby/object:Gem::Requirement
137
137
  requirements:
138
138
  - - "~>"
139
139
  - !ruby/object:Gem::Version
140
- version: '1.73'
140
+ version: '1.91'
141
141
  - - ">="
142
142
  - !ruby/object:Gem::Version
143
- version: 1.73.1
143
+ version: 1.91.0
144
144
  type: :development
145
145
  prerelease: false
146
146
  version_requirements: !ruby/object:Gem::Requirement
147
147
  requirements:
148
148
  - - "~>"
149
149
  - !ruby/object:Gem::Version
150
- version: '1.73'
150
+ version: '1.91'
151
151
  - - ">="
152
152
  - !ruby/object:Gem::Version
153
- version: 1.73.1
153
+ version: 1.91.0
154
154
  - !ruby/object:Gem::Dependency
155
155
  name: rubocop-rake
156
156
  requirement: !ruby/object:Gem::Requirement
@@ -177,34 +177,40 @@ dependencies:
177
177
  requirements:
178
178
  - - "~>"
179
179
  - !ruby/object:Gem::Version
180
- version: '0.22'
180
+ version: '1.3'
181
+ - - ">="
182
+ - !ruby/object:Gem::Version
183
+ version: 1.3.1
181
184
  type: :development
182
185
  prerelease: false
183
186
  version_requirements: !ruby/object:Gem::Requirement
184
187
  requirements:
185
188
  - - "~>"
186
189
  - !ruby/object:Gem::Version
187
- version: '0.22'
190
+ version: '1.3'
191
+ - - ">="
192
+ - !ruby/object:Gem::Version
193
+ version: 1.3.1
188
194
  - !ruby/object:Gem::Dependency
189
195
  name: test-unit
190
196
  requirement: !ruby/object:Gem::Requirement
191
197
  requirements:
192
198
  - - "~>"
193
199
  - !ruby/object:Gem::Version
194
- version: '3.6'
200
+ version: '3.7'
195
201
  - - ">="
196
202
  - !ruby/object:Gem::Version
197
- version: 3.6.7
203
+ version: 3.7.8
198
204
  type: :development
199
205
  prerelease: false
200
206
  version_requirements: !ruby/object:Gem::Requirement
201
207
  requirements:
202
208
  - - "~>"
203
209
  - !ruby/object:Gem::Version
204
- version: '3.6'
210
+ version: '3.7'
205
211
  - - ">="
206
212
  - !ruby/object:Gem::Version
207
- version: 3.6.7
213
+ version: 3.7.8
208
214
  - !ruby/object:Gem::Dependency
209
215
  name: timecop
210
216
  requirement: !ruby/object:Gem::Requirement
@@ -214,7 +220,7 @@ dependencies:
214
220
  version: '0.9'
215
221
  - - ">="
216
222
  - !ruby/object:Gem::Version
217
- version: 0.9.10
223
+ version: 0.9.11
218
224
  type: :development
219
225
  prerelease: false
220
226
  version_requirements: !ruby/object:Gem::Requirement
@@ -224,7 +230,7 @@ dependencies:
224
230
  version: '0.9'
225
231
  - - ">="
226
232
  - !ruby/object:Gem::Version
227
- version: 0.9.10
233
+ version: 0.9.11
228
234
  - !ruby/object:Gem::Dependency
229
235
  name: fluentd
230
236
  requirement: !ruby/object:Gem::Requirement
@@ -245,6 +251,26 @@ dependencies:
245
251
  - - "<"
246
252
  - !ruby/object:Gem::Version
247
253
  version: '2'
254
+ - !ruby/object:Gem::Dependency
255
+ name: procfs_rb
256
+ requirement: !ruby/object:Gem::Requirement
257
+ requirements:
258
+ - - "~>"
259
+ - !ruby/object:Gem::Version
260
+ version: '0.2'
261
+ - - ">="
262
+ - !ruby/object:Gem::Version
263
+ version: 0.2.2
264
+ type: :runtime
265
+ prerelease: false
266
+ version_requirements: !ruby/object:Gem::Requirement
267
+ requirements:
268
+ - - "~>"
269
+ - !ruby/object:Gem::Version
270
+ version: '0.2'
271
+ - - ">="
272
+ - !ruby/object:Gem::Version
273
+ version: 0.2.2
248
274
  email:
249
275
  - thomas.tych@gmail.com
250
276
  executables: []
@@ -256,6 +282,7 @@ files:
256
282
  - README.md
257
283
  - Rakefile
258
284
  - lib/fluent/plugin/in_syscheck_mounts.rb
285
+ - lib/fluent/plugin/in_syscheck_sockets.rb
259
286
  homepage: https://gitlab.com/ttych/fluent-plugin-syscheck
260
287
  licenses:
261
288
  - Apache-2.0
@@ -270,14 +297,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
270
297
  requirements:
271
298
  - - ">="
272
299
  - !ruby/object:Gem::Version
273
- version: 3.1.0
300
+ version: 3.2.0
274
301
  required_rubygems_version: !ruby/object:Gem::Requirement
275
302
  requirements:
276
303
  - - ">="
277
304
  - !ruby/object:Gem::Version
278
305
  version: '0'
279
306
  requirements: []
280
- rubygems_version: 3.6.7
307
+ rubygems_version: 4.0.21
281
308
  specification_version: 4
282
309
  summary: fluentd plugin to check system part
283
310
  test_files: []