fluent-plugin-ufw 0.0.2 → 0.0.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +5 -0
- data/.travis.yml +1 -4
- data/Appraisals +61 -0
- data/Dockerfile +8 -0
- data/Dockerfile.template +8 -0
- data/Gemfile +0 -3
- data/README.md +39 -16
- data/Rakefile +3 -0
- data/docker-compose.yml +6 -0
- data/docker/Dockerfile +8 -0
- data/docker/etc/fluent.conf +18 -0
- data/docker/var/log/ufw/ufw.log +4 -0
- data/fluent-plugin-ufw.gemspec +7 -5
- data/lib/fluent/plugin/parser_ufw.rb +5 -7
- data/run_docker_all_test.sh +8 -0
- data/run_docker_test.sh +7 -0
- data/test/fluent/plugin/test_parser_ufw.rb +2 -2
- data/test/test_helper.rb +0 -1
- metadata +45 -19
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c71257b4fae307040cd23f60bed50163d90b8697
|
4
|
+
data.tar.gz: 07e224c028339bfc0e9c4fb6b86324ed2e85c8b6
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: aa814ea8afb5b0e17c6029abbafb34a0f635bc6b232e79885dff49bc96cc680779618276a3d733712edf730896673084d5d91dc035815d6556fbf61c935f5624
|
7
|
+
data.tar.gz: 5724616c78a568c9a6c13d5588ce9a69ae3c1ed8a7150070717e76b7718899f3de60aa8cfc473dedf0412cf08ebfd0183a7b0c15239aaf19367b65bd0d2c3397
|
data/.travis.yml
CHANGED
@@ -2,6 +2,7 @@ language: ruby
|
|
2
2
|
sudo: true
|
3
3
|
before_install:
|
4
4
|
- gem update bundler
|
5
|
+
- gem update
|
5
6
|
|
6
7
|
rvm:
|
7
8
|
# - 1.9.3
|
@@ -13,7 +14,3 @@ rvm:
|
|
13
14
|
|
14
15
|
gemfile:
|
15
16
|
- Gemfile
|
16
|
-
|
17
|
-
install:
|
18
|
-
- bundle exec rake build
|
19
|
-
- sudo fluent-gem install --local pkg/fluent-plugin-ufw-0.0.1.gem
|
data/Appraisals
ADDED
@@ -0,0 +1,61 @@
|
|
1
|
+
appraise "fluentd-0.12.39" do
|
2
|
+
gem "fluentd", "0.12.39"
|
3
|
+
end
|
4
|
+
|
5
|
+
appraise "test-unit-3" do
|
6
|
+
gem "fluentd", "0.12.39"
|
7
|
+
gem "test-unit", "3.0.0"
|
8
|
+
end
|
9
|
+
|
10
|
+
appraise "test-unit-2" do
|
11
|
+
gem "fluentd", "0.12.39"
|
12
|
+
gem "test-unit", "2.0.0"
|
13
|
+
end
|
14
|
+
|
15
|
+
# ok
|
16
|
+
appraise "test-unit-1" do
|
17
|
+
gem "fluentd", "0.12.39"
|
18
|
+
gem "test-unit", "1.2.3"
|
19
|
+
end
|
20
|
+
|
21
|
+
appraise "rake-0.9.2" do
|
22
|
+
gem "fluentd", "0.12.39"
|
23
|
+
gem "test-unit", "1.2.3"
|
24
|
+
gem "rake", "0.9.2"
|
25
|
+
end
|
26
|
+
|
27
|
+
appraise "appraisal-1.0.0" do
|
28
|
+
gem "fluentd", "0.12.39"
|
29
|
+
gem "test-unit", "1.2.3"
|
30
|
+
gem "rake", "0.9.2"
|
31
|
+
gem "appraisal", "1.0.0"
|
32
|
+
end
|
33
|
+
|
34
|
+
# ok
|
35
|
+
appraise "fluentd-0.12.30" do
|
36
|
+
gem "fluentd", "0.12.30"
|
37
|
+
end
|
38
|
+
|
39
|
+
# ng
|
40
|
+
appraise "fluentd-0.12.29" do
|
41
|
+
gem "fluentd", "0.12.29"
|
42
|
+
end
|
43
|
+
|
44
|
+
# ok
|
45
|
+
appraise "fluentd-0.12.25" do
|
46
|
+
gem "fluentd", "0.12.25"
|
47
|
+
end
|
48
|
+
|
49
|
+
# ok
|
50
|
+
appraise "fluentd-0.12.22" do
|
51
|
+
gem "fluentd", "0.12.22"
|
52
|
+
end
|
53
|
+
|
54
|
+
appraise "fluentd-0.12.21" do
|
55
|
+
gem "fluentd", "0.12.21"
|
56
|
+
end
|
57
|
+
|
58
|
+
# failed
|
59
|
+
#appraise "fluentd-0.12.20" do
|
60
|
+
# gem "fluentd", "0.12.20"
|
61
|
+
#end
|
data/Dockerfile
ADDED
data/Dockerfile.template
ADDED
data/Gemfile
CHANGED
data/README.md
CHANGED
@@ -2,22 +2,12 @@ fluent-plugin-ufw
|
|
2
2
|
==================
|
3
3
|
[![Build Status](https://travis-ci.org/mamewotoko/fluent-plugin-ufw.svg?branch=master)](https://travis-ci.org/mamewotoko/fluent-plugin-ufw)
|
4
4
|
|
5
|
-
A fluent plugin to parse [ufw](https://help.ubuntu.com/community/UFW) log
|
5
|
+
A [fluent](https://www.fluentd.org/) plugin to parse [ufw](https://help.ubuntu.com/community/UFW) log
|
6
6
|
|
7
7
|
## Installation
|
8
|
-
either A or B
|
9
|
-
|
10
|
-
### A. build gem file and install
|
11
8
|
|
12
9
|
```
|
13
|
-
|
14
|
-
sudo fluent-gem install --local pkg/fluent-plugin-ufw-0.0.1.gem
|
15
|
-
```
|
16
|
-
|
17
|
-
### B. copy plugin file
|
18
|
-
|
19
|
-
```
|
20
|
-
cp lib/fluent/plugin/parser_ufw.rb /etc/fluent/plugin/
|
10
|
+
gem install fluent-plugin-ufw
|
21
11
|
```
|
22
12
|
|
23
13
|
## fluentd config
|
@@ -29,7 +19,7 @@ specify `format ufw` in fluent.config like example below.
|
|
29
19
|
read_from_head true
|
30
20
|
format ufw
|
31
21
|
|
32
|
-
path /var/log/ufw/ufw.log
|
22
|
+
path /var/log/ufw/ufw.log
|
33
23
|
pos_file /var/log/ufw/ufw.pos
|
34
24
|
tag ufw.combined
|
35
25
|
</source>
|
@@ -39,14 +29,47 @@ specify `format ufw` in fluent.config like example below.
|
|
39
29
|
* read [Interpreting Log Entries of UFW](https://help.ubuntu.com/community/UFW#Interpreting_Log_Entries)
|
40
30
|
|
41
31
|
## Test
|
42
|
-
|
32
|
+
### A. Using installed fluetntd
|
43
33
|
```
|
44
34
|
bundle install
|
45
35
|
bundle exec rake
|
46
36
|
```
|
47
37
|
|
48
|
-
|
49
|
-
|
38
|
+
### B. Multiple version of fluentd with appraisal tool
|
39
|
+
|
40
|
+
```
|
41
|
+
bundle install
|
42
|
+
appraisal install
|
43
|
+
appraisal rake test
|
44
|
+
```
|
45
|
+
|
46
|
+
### C. Install gem and run with fluentd as docker container
|
47
|
+
|
48
|
+
Run for fluentd version specified in Dockerfile
|
49
|
+
|
50
|
+
```
|
51
|
+
sh run_docker_test.sh
|
52
|
+
```
|
53
|
+
|
54
|
+
Run for multiple fluentd version
|
55
|
+
|
56
|
+
```
|
57
|
+
sh run_docker_test.sh
|
58
|
+
```
|
59
|
+
|
60
|
+
## Install for development
|
61
|
+
### A. build gem file and install
|
62
|
+
|
63
|
+
```
|
64
|
+
bundle exec rake build
|
65
|
+
gem install --local pkg/fluent-plugin-ufw-0.0.1.gem
|
66
|
+
```
|
67
|
+
|
68
|
+
### B. copy plugin file
|
69
|
+
|
70
|
+
```
|
71
|
+
cp lib/fluent/plugin/parser_ufw.rb /etc/fluent/plugin/
|
72
|
+
```
|
50
73
|
|
51
74
|
## License
|
52
75
|
|
data/Rakefile
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
require "rubygems"
|
2
|
+
require "bundler/setup"
|
1
3
|
require "bundler/gem_tasks"
|
2
4
|
require "rake/testtask"
|
3
5
|
|
@@ -5,6 +7,7 @@ Rake::TestTask.new(:test) do |t|
|
|
5
7
|
t.libs << "test"
|
6
8
|
t.libs << "lib"
|
7
9
|
t.test_files = FileList["test/**/test_*.rb"]
|
10
|
+
t.warning = false
|
8
11
|
end
|
9
12
|
|
10
13
|
task :default => :test
|
data/docker-compose.yml
ADDED
data/docker/Dockerfile
ADDED
@@ -0,0 +1,18 @@
|
|
1
|
+
<source>
|
2
|
+
@type tail
|
3
|
+
time_key time
|
4
|
+
read_from_head true
|
5
|
+
format ufw
|
6
|
+
|
7
|
+
path /var/log/ufw/ufw.log
|
8
|
+
pos_file /home/fluent/ufw.pos
|
9
|
+
tag ufw.combined
|
10
|
+
</source>
|
11
|
+
|
12
|
+
<match ufw.*>
|
13
|
+
@type file
|
14
|
+
path /home/fluent/ufw.output
|
15
|
+
time_slice_format %Y%m%d
|
16
|
+
time_slice_wait 10m
|
17
|
+
time_format %Y%m%dT%H%M%S%z
|
18
|
+
</match>
|
@@ -0,0 +1,4 @@
|
|
1
|
+
Jul 30 19:11:59 myhost kernel: [169367.853115] [UFW BLOCK] IN=ens3 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
|
2
|
+
Jul 30 19:14:03 myhost kernel: [169491.362232] [UFW BLOCK] IN=ens3 OUT= MAC=9c:a3:ba:01:f0:06:cc:4e:24:93:d1:00:08:00 SRC=185.35.62.142 DST=1.2.3.4 LEN=76 TOS=0x00 PREC=0x00 TTL=234 ID=54321 PROTO=UDP SPT=60282 DPT=123 LEN=56
|
3
|
+
Jul 30 19:14:04 myhost kernel: [169492.853269] [UFW BLOCK] IN=ens3 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
|
4
|
+
Jul 30 19:14:30 myhost kernel: [169518.429545] [UFW BLOCK] IN=ens3 OUT= MAC=9c:a3:ba:01:f0:06:cc:4e:24:93:d2:00:08:00 SRC=78.170.69.46 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=37633 PROTO=TCP SPT=42772 DPT=23 WINDOW=14600 RES=0x00 SYN URGP=0
|
data/fluent-plugin-ufw.gemspec
CHANGED
@@ -3,7 +3,7 @@ $:.push File.expand_path("../lib", __FILE__)
|
|
3
3
|
|
4
4
|
Gem::Specification.new do |s|
|
5
5
|
s.name = "fluent-plugin-ufw"
|
6
|
-
s.version = "0.0.
|
6
|
+
s.version = "0.0.3"
|
7
7
|
s.authors = ["Takashi Masuyama"]
|
8
8
|
s.email = ["mamewotoko@gmail.com"]
|
9
9
|
s.homepage = "https://github.com/mamewotoko/fluent-plugin-ufw"
|
@@ -11,12 +11,14 @@ Gem::Specification.new do |s|
|
|
11
11
|
s.description = %q{Fluentd plugin to parse ufw log}
|
12
12
|
|
13
13
|
s.files = `git ls-files`.split("\n")
|
14
|
-
s.test_files = `git ls-files --
|
14
|
+
s.test_files = `git ls-files -- test/*`.split("\n")
|
15
15
|
s.executables = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
|
16
16
|
s.require_paths = ["lib"]
|
17
17
|
s.license = "Apache-2.0"
|
18
18
|
|
19
|
-
s.
|
20
|
-
|
21
|
-
s.
|
19
|
+
s.add_runtime_dependency "fluentd", [">= 0.12.21"]
|
20
|
+
|
21
|
+
s.add_development_dependency "rake", [">= 0.9.2"]
|
22
|
+
s.add_development_dependency "test-unit", [">= 1.2.3"]
|
23
|
+
s.add_development_dependency "appraisal"
|
22
24
|
end
|
@@ -4,7 +4,7 @@ module Fluent
|
|
4
4
|
class TextParser
|
5
5
|
class UFWParser < Parser
|
6
6
|
# Register this parser as "time_key_value"
|
7
|
-
Plugin.register_parser("ufw", self)
|
7
|
+
Fluent::Plugin.register_parser("ufw", self)
|
8
8
|
|
9
9
|
def configure(conf)
|
10
10
|
super
|
@@ -15,6 +15,7 @@ module Fluent
|
|
15
15
|
# TimeParser class is already given. It takes a single argument as the time format
|
16
16
|
# to parse the time string with.
|
17
17
|
@time_parser = TimeParser.new(@time_format)
|
18
|
+
@mutex = Mutex.new
|
18
19
|
end
|
19
20
|
|
20
21
|
def parse(text)
|
@@ -25,7 +26,7 @@ module Fluent
|
|
25
26
|
return
|
26
27
|
end
|
27
28
|
time = m['time']
|
28
|
-
time = @time_parser.parse(time)
|
29
|
+
time = @mutex.synchronize { @time_parser.parse(time) }
|
29
30
|
host = m['host']
|
30
31
|
action = m['action']
|
31
32
|
|
@@ -39,11 +40,8 @@ module Fluent
|
|
39
40
|
key, value = pair.split('=', 2)
|
40
41
|
record[key] = value
|
41
42
|
end
|
42
|
-
|
43
|
-
|
44
|
-
# $log.info "#{key} #{value}"
|
45
|
-
# }
|
46
|
-
time, record = convert_values(time, record)
|
43
|
+
record['time'] = m['time'] if @keep_time_key
|
44
|
+
|
47
45
|
yield time, record
|
48
46
|
end
|
49
47
|
end
|
data/run_docker_test.sh
ADDED
@@ -32,8 +32,8 @@ class UFWTest < Test::Unit::TestCase
|
|
32
32
|
|
33
33
|
def test_parse
|
34
34
|
@parser.instance.parse('Aug 1 19:03:54 hostnm kernel: [341682.476244] [UFW BLOCK] IN=br-9e24f5d888e0 OUT= PHYSIN=veth9f1178d MAC=02:42:e1:a2:93:db:02:42:ac:13:00:02:08:00 SRC=172.19.0.2 DST=172.19.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=38516 DF PROTO=TCP SPT=7777 DPT=49338 WINDOW=0 RES=0x00 RST URGP=0 ') { |time, record|
|
35
|
-
expected_time =
|
36
|
-
assert_equal(expected_time, time)
|
35
|
+
expected_time = Time.strptime('1/Aug 19:03:54', '%d/%b %H:%M:%S')
|
36
|
+
assert_equal(expected_time.to_i, time.to_i)
|
37
37
|
assert_equal(@expected, record)
|
38
38
|
}
|
39
39
|
end
|
data/test/test_helper.rb
CHANGED
metadata
CHANGED
@@ -1,55 +1,69 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-ufw
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Takashi Masuyama
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2017-08-
|
11
|
+
date: 2017-08-05 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: fluentd
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - '>='
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: 0.12.21
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - '>='
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: 0.12.21
|
13
27
|
- !ruby/object:Gem::Dependency
|
14
28
|
name: rake
|
15
29
|
requirement: !ruby/object:Gem::Requirement
|
16
30
|
requirements:
|
17
|
-
- -
|
31
|
+
- - '>='
|
18
32
|
- !ruby/object:Gem::Version
|
19
|
-
version:
|
33
|
+
version: 0.9.2
|
20
34
|
type: :development
|
21
35
|
prerelease: false
|
22
36
|
version_requirements: !ruby/object:Gem::Requirement
|
23
37
|
requirements:
|
24
|
-
- -
|
38
|
+
- - '>='
|
25
39
|
- !ruby/object:Gem::Version
|
26
|
-
version:
|
40
|
+
version: 0.9.2
|
27
41
|
- !ruby/object:Gem::Dependency
|
28
42
|
name: test-unit
|
29
43
|
requirement: !ruby/object:Gem::Requirement
|
30
44
|
requirements:
|
31
|
-
- -
|
45
|
+
- - '>='
|
32
46
|
- !ruby/object:Gem::Version
|
33
|
-
version:
|
47
|
+
version: 1.2.3
|
34
48
|
type: :development
|
35
49
|
prerelease: false
|
36
50
|
version_requirements: !ruby/object:Gem::Requirement
|
37
51
|
requirements:
|
38
|
-
- -
|
52
|
+
- - '>='
|
39
53
|
- !ruby/object:Gem::Version
|
40
|
-
version:
|
54
|
+
version: 1.2.3
|
41
55
|
- !ruby/object:Gem::Dependency
|
42
|
-
name:
|
56
|
+
name: appraisal
|
43
57
|
requirement: !ruby/object:Gem::Requirement
|
44
58
|
requirements:
|
45
|
-
- -
|
59
|
+
- - '>='
|
46
60
|
- !ruby/object:Gem::Version
|
47
61
|
version: '0'
|
48
|
-
type: :
|
62
|
+
type: :development
|
49
63
|
prerelease: false
|
50
64
|
version_requirements: !ruby/object:Gem::Requirement
|
51
65
|
requirements:
|
52
|
-
- -
|
66
|
+
- - '>='
|
53
67
|
- !ruby/object:Gem::Version
|
54
68
|
version: '0'
|
55
69
|
description: Fluentd plugin to parse ufw log
|
@@ -59,13 +73,23 @@ executables: []
|
|
59
73
|
extensions: []
|
60
74
|
extra_rdoc_files: []
|
61
75
|
files:
|
62
|
-
-
|
76
|
+
- .gitignore
|
77
|
+
- .travis.yml
|
78
|
+
- Appraisals
|
79
|
+
- Dockerfile
|
80
|
+
- Dockerfile.template
|
63
81
|
- Gemfile
|
64
82
|
- LICENSE.txt
|
65
83
|
- README.md
|
66
84
|
- Rakefile
|
85
|
+
- docker-compose.yml
|
86
|
+
- docker/Dockerfile
|
87
|
+
- docker/etc/fluent.conf
|
88
|
+
- docker/var/log/ufw/ufw.log
|
67
89
|
- fluent-plugin-ufw.gemspec
|
68
90
|
- lib/fluent/plugin/parser_ufw.rb
|
91
|
+
- run_docker_all_test.sh
|
92
|
+
- run_docker_test.sh
|
69
93
|
- test/fluent/plugin/test_parser_ufw.rb
|
70
94
|
- test/test_helper.rb
|
71
95
|
homepage: https://github.com/mamewotoko/fluent-plugin-ufw
|
@@ -78,18 +102,20 @@ require_paths:
|
|
78
102
|
- lib
|
79
103
|
required_ruby_version: !ruby/object:Gem::Requirement
|
80
104
|
requirements:
|
81
|
-
- -
|
105
|
+
- - '>='
|
82
106
|
- !ruby/object:Gem::Version
|
83
107
|
version: '0'
|
84
108
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
85
109
|
requirements:
|
86
|
-
- -
|
110
|
+
- - '>='
|
87
111
|
- !ruby/object:Gem::Version
|
88
112
|
version: '0'
|
89
113
|
requirements: []
|
90
114
|
rubyforge_project:
|
91
|
-
rubygems_version: 2.
|
115
|
+
rubygems_version: 2.0.14.1
|
92
116
|
signing_key:
|
93
117
|
specification_version: 4
|
94
118
|
summary: Fluentd plugin to parse ufw log
|
95
|
-
test_files:
|
119
|
+
test_files:
|
120
|
+
- test/fluent/plugin/test_parser_ufw.rb
|
121
|
+
- test/test_helper.rb
|