fluent-plugin-viaq_docker_audit_log_parser 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9a041ae8be29fd0671885a00cf1ed555f3972be2
-  data.tar.gz: e55ecd2d98b0f6f8465b8cfeac821660685b183a
+  metadata.gz: b66eaf9810fb73e129c5c80d2160a25b84056dcf
+  data.tar.gz: ba324dd764f534c2a88f9a9436cc8b447577deeb
 SHA512:
-  metadata.gz: 254c499b158f7fd0eb0fb5078a33f4ab1ec42391e22facc3bb0c1d88a2ed1735e90494b39880313cd8d450f82a0929856be6b34ea55db6239295e46df4de3948
-  data.tar.gz: b691bc3eaf9b2d00f5ab5eb8a74f2f96819f8021acd9a61381f190b3d6563661a5c503b2cf4c06f2ebe7b418e1d79ea5f0bf60c1fd070a8676daa3badf57478b
+  metadata.gz: 4a6928953f720c1a0ed7fd967a592738c7e845dff2423668853b3f3ebf255f863a919615e7f40bc0bfe422327ef41a143bd600cd63b4896612f509258522a80c
+  data.tar.gz: '09644a068ce88a790512c501d365f0728bd424c96194b1a1de8c51ff1f9795669fc3c0422e143aa39928ab38ef5cd151cc9b67369ff783ecee22dceae1306e9a'

data/lib/fluent/plugin/{parser_auditd.rb → parser_viaq_docker_audit.rb}

@@ -1,19 +1,19 @@
-require "fluent/plugin/auditd"
+require "fluent/plugin/viaq_docker_audit"
 require 'fluent/parser'
 require 'fluent/time'
 
 module Fluent
-  class AuditdParser < Parser
-    Plugin.register_parser("auditd", self)
+  class ViaqDockerAuditParser < Parser
+    Plugin.register_parser("viaq_docker_audit", self)
 
     def configure(conf={})
       super
-      @auditd = Auditd.new()
+      @audit_parser = ViaqDockerAudit.new()
     end
 
     def parse(text)
       begin
-        parsed_line = @auditd.parse_auditd_line text
+        parsed_line = @audit_parser.parse_audit_line text
         time = parsed_line.nil? ? Time.now.to_f : DateTime.parse(parsed_line['time']).to_time.to_f
 
         # All other logs than virt-control should be ignored.
@@ -24,10 +24,10 @@ module Fluent
         parsed_line = {"virt-control" => "false"} if parsed_line.nil?
 
         yield time, parsed_line
-      rescue Fluent::Auditd::AuditdParserException => e
+      rescue Fluent::ViaqDockerAudit::ViaqDockerAuditParserException => e
         log.error e.message
         yield nil, nil
       end
     end
   end
-end
+end

data/lib/fluent/plugin/{auditd.rb → viaq_docker_audit.rb}

@@ -2,9 +2,9 @@ require 'time'
 
 # Parses docker audit log to format that fits Origin Aggregated Logging
 module Fluent
-  class Auditd
+  class ViaqDockerAudit
 
-    class AuditdParserException < StandardError
+    class ViaqDockerAuditParserException < StandardError
     end
 
     # Keys as found in raw audit.log messsages
@@ -53,7 +53,7 @@ module Fluent
     # Takes one line from audit.log and returns hash
     # that fits the OAL format.
     # Messages of other types than 'virt_control' are ignored.
-    def parse_auditd_line(line)
+    def parse_audit_line(line)
       if filter_virt_control(line)
         event = {}
         docker = {}
@@ -62,7 +62,7 @@ module Fluent
           parse_msg(docker, metadata['g2'].split)
           event[IN_EVENT_TYPE] = docker
         else
-          raise AuditdParserException, "Couldn't parse message: #{line}"
+          raise ViaqDockerAuditParserException, "Couldn't parse message: #{line}"
         end
         return normalize(event)
       end
@@ -149,4 +149,4 @@ module Fluent
     end
 
   end
-end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-viaq_docker_audit_log_parser
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: ruby
 authors:
 - Josef Karasek
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-10 00:00:00.000000000 Z
+date: 2017-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -73,9 +73,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- lib/fluent/plugin/auditd.rb
-- lib/fluent/plugin/parser_auditd.rb
-- test/test_auditd_parser.rb
+- lib/fluent/plugin/parser_viaq_docker_audit.rb
+- lib/fluent/plugin/viaq_docker_audit.rb
 homepage: https://github.com/viaq/fluent-plugin-viaq_docker_audit_log_parser
 licenses:
 - Apache-2.0
@@ -100,5 +99,4 @@ rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: Fluentd plugin for parsing atomic-project docker auditd logs
-test_files:
-- test/test_auditd_parser.rb
+test_files: []

data/test/test_auditd_parser.rb

@@ -1,61 +0,0 @@
-require 'fluent/test'
-require 'fluent/parser'
-require 'json'
-require_relative '../lib/fluent/plugin/auditd'
-
-
-module ParserTest
-  include Fluent
-  
-  class AuditdParserTest < ::Test::Unit::TestCase
-
-    def setup()
-      @parser = Fluent::Auditd.new()
-    end
-    
-    data('line' => [
-'{
-  "type": "VIRT_CONTROL",
-  "time": "1505977228.725",
-  "pid": "1115",
-  "uid": "0",
-  "auid": "4294967295",
-  "ses": "4294967295",
-  "subj": "system_u:system_r:container_runtime_t:s0",
-  "msg": {
-    "auid": "1000",
-    "reason": "api",
-    "op": "_ping",
-    "user": "jkarasek",
-    "exe": "\"/usr/bin/dockerd-current\"",
-    "res": "success"
-  }
-}', "type=VIRT_CONTROL msg=audit(1506321923.246:470): pid=1182 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:container_runtime_t:s0 msg='reason=api vm-pid=10657 hostname=1235c5a6476b op=resize vm=centos:7 user=origin auid=1000 exe=sleep  exe=\"/usr/bin/dockerd-current\" hostname=? addr=? terminal=? res=success'"])
-    def test_correct_data(data)
-      expected, target = data
-      puts JSON.pretty_generate (@parser.parse_auditd_line target)
-      # begin
-      #   expected, target = data
-      #   target_json = JSON.pretty_generate (@parser.parse_auditd_line target)
-      #   assert_equal(expected, target_json)
-      # rescue Fluent::Auditd::AuditdParserException => e
-      #   fail(e.message)
-      # end
-    end
-
-    data('line' => ["expecting AuditdParserException", "type=VIRT_CONTROL msg=audit(1505977228.725:3309): pid=1115 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:container_runtime_t:s0 msg='auid=1000 exe=? reason=api op=_ping vm=? vm-pid=? user=jkarasek hostname=?  exe=\"/usr/bin/dockerd-current\" hostname=? addr=? terminal=? res=success"])
-    def test_missing_apostrophe(data)
-      expected, target = data
-      assert_raise Fluent::Auditd::AuditdParserException do 
-        JSON.pretty_generate (@parser.parse_auditd_line target)
-      end
-    end
-
-    private
-
-    def fail(reason)
-      assert(false, reason)
-    end
-
-  end
-end