fluent-plugin-syscheck 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 793b60b98e80ea983169dec24aaf13725d3dfa93e0f73c05c49a325a9a8103ab
-  data.tar.gz: 976bc5154d1b1a93047f75aaa2bcd933844bb604e07e53619d9d6dc97b8cf471
+  metadata.gz: 2bc041b693f90f1f23d310693316e2b701b0e50f2d1bd25a14c19262276a8fd4
+  data.tar.gz: ceedc1c200a01e263376648f13b76e61e206abbb6e1bd64b68f857daa0467731
 SHA512:
-  metadata.gz: daeb3dbc21f3bce7b804eeb060475285bdfcb103860d84c2845c12e18da7ff80b423e6859013dca7c25b2e49fae3329275b00b109c54d02476e29a06431bdc51
-  data.tar.gz: '08c092e9e4552c8f2177bfab4496157ba9f6088adaba318f7766f4fbeb23e7baa5ce616378efe25591e8fbefc3b5f3843b38848b7654a7838229e6c3045140aa'
+  metadata.gz: d4dfaca6197db517be8144fb82e2d2a3acbf35b09ffacda6b407d33eff852f005d81fc535e0e3f2b19176c2681bdc68549fa33cb795c7cf5e2a27d022316c443
+  data.tar.gz: 75bf00cfaf0083a6ae528067f85e1dc7e16109a25aea28c75c609d841cbf98259d7b06b03e270aa8f44f77d46750d292191f8a3451e7a2bb7b9b7a0af78d47c7

data/.rubocop.yml

@@ -10,6 +10,14 @@ AllCops:
 Gemspec/DevelopmentDependencies:
   EnforcedStyle: gemspec
 
+Layout/LineLength:
+  Max: 120
+
+Metrics/AbcSize:
+  Max: 25
+  Exclude:
+    - 'test/**/test*.rb'
+
 Metrics/BlockLength:
   Exclude:
     - fluent-plugin-syscheck.gemspec
@@ -19,6 +27,12 @@ Metrics/ClassLength:
   Exclude:
     - test/**/*.rb
 
+Metrics/MethodLength:
+  Max: 20
+
+Metrics/ParameterLists:
+  Max: 12
+
 Style/Documentation:
   Enabled: false
 

data/lib/fluent/plugin/in_syscheck_mounts.rb

@@ -17,7 +17,7 @@
 
 require 'fluent/plugin/input'
 
-# rubocop:disable-next Metrics/AbcSize, Metrics/ClassLength, Metrics/MethodLength
+# rubocop:disable-next Metrics/ClassLength, Metrics/MethodLength
 module Fluent
   module Plugin
     class SyscheckMountsInput < Fluent::Plugin::Input

data/lib/fluent/plugin/in_syscheck_sockets.rb

@@ -58,32 +58,62 @@ module Fluent
 
       def run_check
         run_check_tcp4
+        run_check_tcp6
+      rescue StandardError => e
+        log.error "#{NAME}: error during check: #{e}"
       end
 
       def run_check_tcp4
         tcp4_content = read_file_content('/proc/net/tcp')
-        parser = ProcFS::Parser::NetTcpParser.new
+        return if tcp4_content.nil?
+
+        parser = ProcFS::Parser::NetTcpParser.ipv4
         tcp4_info = parser.parse(tcp4_content)
 
         emit_list_sockets(tcp4_info) if list_sockets
       end
 
+      def run_check_tcp6
+        tcp6_content = read_file_content('/proc/net/tcp6')
+        return if tcp6_content.nil?
+
+        parser = ProcFS::Parser::NetTcpParser.ipv6
+        tcp6_info = parser.parse(tcp6_content)
+
+        emit_list_sockets(tcp6_info) if list_sockets
+      end
+
       def emit_list_sockets(sockets)
         log.debug "#{NAME}: emit list_sockets"
 
         event_time = Fluent::EventTime.from_time(sockets.timestamp)
         sockets.each do |socket|
+          socket_event = sanitize_record(socket.to_h)
           router.emit(
             tag,
             event_time,
-            socket.to_h
-              .merge('timestamp' => sockets.timestamp.iso8601(3))
+            socket_event
           )
         end
       end
 
       private
 
+      def sanitize_record(record)
+        case record
+        when Hash
+          record.each_with_object({}) do |(k, v), new_hash|
+            new_hash[k.to_s] = sanitize_record(v)
+          end
+        when Array
+          record.map { |v| sanitize_record(v) }
+        when String, Integer, Float, TrueClass, FalseClass, NilClass
+          record
+        else
+          record.to_s
+        end
+      end
+
       def read_file_content(path)
         File.read(path)
       rescue Errno::ENOENT => e

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-syscheck
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Thomas Tych
@@ -257,20 +257,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.2.2
 email:
 - thomas.tych@gmail.com
 executables: []