fluent-plugin-syscheck 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 277e0647f0be28efd0add255e8a1082cc4b35523da31f1bc3ad106ed53deb1b8
-  data.tar.gz: 3349b001ba0a1868ad26a2bb2b64b0485aa12291d0d637434a2c416b1c9395af
+  metadata.gz: 1fc9cd18d52c75a1db0b29d655b74a9b4830b66aab86b3e04d291cf2f1555261
+  data.tar.gz: 46d2984fdbe048eda60e01787cb2e7cddbc1e5a7589e1cb1223d35b327d40538
 SHA512:
-  metadata.gz: d87e0d84a7c82f21fb498b183d0d50ab7fa5af7e08c49aa1d5691558d8dd879ab0306a4fac80783a52944a9c066eb505ab9118a1a035424c3b52ce706f136212
-  data.tar.gz: 924b6fd66acb1cbf11bd0cabbf8392db47205fbd586484ea0ca3d3ff483b46797d416dcaa7c06b8c16e7bd2b8110eeecc0961e6f8b81e9862f1d4c597e3beccf
+  metadata.gz: b42c43682f9af8cff35d02fb7684065c8fbdcf73834504f0c266b798147eccdf56c3071149987f8482447c023a95de1d04e22860f79052cd091c2c5f54344da8
+  data.tar.gz: f8407c1f94804b6fa23949f72412d96ad3fe57dbb1eaaaccd6fd522aaeb5d0c6653778b371fc8a691fb88ed6cebc4871145a002b4cda3fd65d861e120482dba9

data/README.md

@@ -32,8 +32,29 @@ $ bundle
 
 ### configuration
 
+Parameters are:
+
+| parameter         | type   | purpose                                  |
+|-------------------|--------|------------------------------------------|
+| tag               | string | tag to emit event on                     |
+| interval          | time   | interval to exec mount check             |
+| timeout           | time   | timeout for a mountpoint check           |
+| enabled_fs_types  | array  | list of fstype to enable only            |
+| disabled_fs_types | array  | list of fstype to disable explicitly     |
+| error_only        | bool   | generate event on mount check error only |
+
 ### examples
 
+``` text
+<source>
+  @type syscheck_mounts
+
+  tag test
+  interval 10
+  enabled_fs_types zfs, xfs
+  error_only false
+</source>
+```
 
 ## Copyright
 

data/lib/fluent/plugin/in_syscheck_mounts.rb

@@ -15,11 +15,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require 'ostruct'
-
 require 'fluent/plugin/input'
 
-# rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+# rubocop:disable Metrics/AbcSize, Metrics/ClassLength, Metrics/MethodLength
 module Fluent
   module Plugin
     class SyscheckMountsInput < Fluent::Plugin::Input
@@ -36,17 +34,43 @@ module Fluent
       desc 'interval for probe execution'
       config_param :interval, :time, default: INTERVAL
       desc 'The timeout in second for the check execution'
-      config_param :timeout, :integer, default: TIMEOUT
-
-      ENABLED_FS_TYPE = nil
-      DISABLED_FS_TYPE = %w[sysfs proc devpts bpf devtmpfs debugfs tracefs binfmt_misc
-                            efivarfs cgroup cgroup2 securityfs configfs fusectl mqueue
-                            pstore hugetlbfs].freeze
+      config_param :timeout, :time, default: TIMEOUT
+
+      ENABLED_FS_TYPES = nil
+      DISABLED_FS_TYPES = %w[
+        binfmt_misc
+        bpf
+        cgroup
+        cgroup2
+        configfs
+        debugfs
+        devpts
+        devtmpfs
+        efivarfs
+        fusectl
+        hugetlbfs
+        mqueue
+        proc
+        pstore
+        rpc_pipefs
+        securityfs
+        squashfs
+        sysfs
+        tracefs
+      ].freeze
 
       desc 'Enabled FS types'
-      config_param :enabled_fs_types, :array, value_type: :string, default: ENABLED_FS_TYPE
+      config_param :enabled_fs_types, :array, value_type: :string, default: ENABLED_FS_TYPES
       desc 'Disabled FS types'
-      config_param :disabled_fs_types, :array, value_type: :string, default: DISABLED_FS_TYPE
+      config_param :disabled_fs_types, :array, value_type: :string, default: DISABLED_FS_TYPES
+
+      ENABLED_PATHS = nil
+      DISABLED_PATHS = [].freeze
+
+      desc 'Enabled Paths'
+      config_param :enabled_paths, :array, value_type: :regexp, default: ENABLED_PATHS
+      desc 'Disabled Paths'
+      config_param :disabled_paths, :array, value_type: :regexp, default: DISABLED_PATHS
 
       ERROR_ONLY = true
 
@@ -82,13 +106,35 @@ module Fluent
       def system_mounts
         File.readlines('/proc/mounts').map do |mount_line|
           device, mountpoint, fstype, _rest = mount_line.split
-          next if enabled_fs_types && !enabled_fs_types.include?(fstype)
-          next if disabled_fs_types&.include?(fstype)
+          next unless enabled_fs_type?(fstype)
+          next if disabled_fs_type?(fstype)
+          next unless enabled_path?(mountpoint)
+          next if disabled_path?(mountpoint)
 
           SysMount.new(device: device, mountpoint: mountpoint, fstype: fstype)
         end.compact
       end
 
+      def enabled_fs_type?(fstype)
+        return true unless enabled_fs_types
+
+        enabled_fs_types.include?(fstype)
+      end
+
+      def disabled_fs_type?(fstype)
+        disabled_fs_types&.include?(fstype)
+      end
+
+      def enabled_path?(path)
+        return true unless enabled_paths
+
+        enabled_paths.any? { |path_pattern| path_pattern.match?(path) }
+      end
+
+      def disabled_path?(path)
+        disabled_paths.any? { |path_pattern| path_pattern.match?(path) }
+      end
+
       def stat_async(mount)
         reader, writer = IO.pipe
 
@@ -119,8 +165,6 @@ module Fluent
         SysMountStatus.new(result)
       end
 
-
-
       def emit_mount_status(mount, status)
         log.debug "#{mount.mountpoint} (#{mount.fstype}): status - #{status}"
 
@@ -178,4 +222,4 @@ module Fluent
     end
   end
 end
-# rubocop:enable Metrics/AbcSize, Metrics/MethodLength
+# rubocop:enable Metrics/AbcSize, Metrics/ClassLength, Metrics/MethodLength

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-syscheck
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Thomas Tych
@@ -63,6 +63,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 11.1.3
+- !ruby/object:Gem::Dependency
+  name: irb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement