soar_auditing_provider 1.0.0 → 1.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +4 -4
- data/lib/soar_auditing_provider/auditing_provider.rb +6 -5
- data/lib/soar_auditing_provider/version.rb +1 -1
- data/sanity/sanity.rb +1 -1
- data/sanity/sanity_benchmark.rb +4 -4
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 9cfff41987c79b02a5a35893b286b3770ecaa9f6
|
4
|
+
data.tar.gz: 696249e89783169ff5c77c50b77638595d740a94
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5050b6588dbdded12927a93bc6d9dc76f55f51ebb2950a1c6a122d7b795b2d8fdd4e6562ad26e63e70e5c5f78673b9398f5c1adb34fec334bfa40e96f7b604d3
|
7
|
+
data.tar.gz: 98f9cd2beedff794442784f18067e521b6e2a5c16ba1c0440e445d19a16ffd83aaf6f92a68bb78e95d4d020c0246b259bd604e72ef57b8d407614e7d9209bd67
|
data/README.md
CHANGED
@@ -1,6 +1,6 @@
|
|
1
1
|
# SoarAuditingProvider
|
2
2
|
|
3
|
-
[![Gem Version](https://badge.fury.io/rb/soar_auditing_provider.png)](https://badge.fury.io/rb/soar_auditing_provider)
|
3
|
+
[![Gem Version](https://badge.fury.io/rb/soar_auditing_provider.png)](https://badge.fury.io/rb/soar_auditing_provider)
|
4
4
|
|
5
5
|
This gem provides an auditing provider for the SOAR architecture.
|
6
6
|
|
@@ -84,7 +84,7 @@ myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION[
|
|
84
84
|
|
85
85
|
In order to associate all startup and shutdown related audit events with each other it is useful to set an instance flow identifier. Generate an unique flow identifier and pass to the auditing provider. Optional but very useful.
|
86
86
|
```ruby
|
87
|
-
myauditing.
|
87
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
88
88
|
```
|
89
89
|
|
90
90
|
When auditing to a local file there is no need to identify each audit event with a specific service since each service probably has its own audit file. However, when merging audit events to a centralized system it is vital to associate each audit event with a specific service and instance thereof. Set an unique service identifer that will form part of each audit event as follow:
|
@@ -154,7 +154,7 @@ class Main
|
|
154
154
|
def test_sanity
|
155
155
|
#create and configure auditing instance
|
156
156
|
myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION['auditing'] )
|
157
|
-
myauditing.
|
157
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
158
158
|
myauditing.service_identifier = 'my-test-service.com'
|
159
159
|
|
160
160
|
#associate a set of auditing entries with a flow by generating a flow identifiers
|
@@ -190,7 +190,7 @@ The auditing provider automatically chains a hook into the Kernel at_exit method
|
|
190
190
|
|
191
191
|
Provision has been made for out-of-band status/statistics gathering inside the auditing provider. The hash containing the status/statistics is accessible using the status method call:
|
192
192
|
```ruby
|
193
|
-
myauditing.
|
193
|
+
myauditing.detailed_status
|
194
194
|
```
|
195
195
|
|
196
196
|
At present only the buffer overflow count is avialable:
|
@@ -17,7 +17,7 @@ module SoarAuditingProvider
|
|
17
17
|
|
18
18
|
public
|
19
19
|
|
20
|
-
attr_accessor :
|
20
|
+
attr_accessor :startup_flow_id
|
21
21
|
attr_accessor :service_identifier
|
22
22
|
attr_reader :configuration
|
23
23
|
|
@@ -67,8 +67,9 @@ module SoarAuditingProvider
|
|
67
67
|
enqueue(:info, format(:info, prepend_caller_information(data), flow_identifier))
|
68
68
|
end
|
69
69
|
|
70
|
-
def
|
71
|
-
{ 'audit_buffer_overflows' => @buffer_overflow_count
|
70
|
+
def detailed_status
|
71
|
+
{ 'audit_buffer_overflows' => @buffer_overflow_count,
|
72
|
+
'startup_flow_id' => @startup_flow_id }
|
72
73
|
end
|
73
74
|
|
74
75
|
def flush
|
@@ -95,14 +96,14 @@ module SoarAuditingProvider
|
|
95
96
|
|
96
97
|
def exit_cleanup(exception = nil)
|
97
98
|
audit_exception_message(exception) if exception
|
98
|
-
info("Application exit",@
|
99
|
+
info("Application exit",@startup_flow_id)
|
99
100
|
flush
|
100
101
|
end
|
101
102
|
|
102
103
|
def audit_exception_message(exception)
|
103
104
|
exception_message = "#{exception.class}: #{exception.message}"
|
104
105
|
exception_message = exception_message + ":\n\t" + exception.backtrace.join("\n\t") if ENV['RACK_ENV'] == 'development'
|
105
|
-
fatal(exception_message,@
|
106
|
+
fatal(exception_message,@startup_flow_id)
|
106
107
|
end
|
107
108
|
|
108
109
|
def enqueue(level, data)
|
data/sanity/sanity.rb
CHANGED
@@ -39,7 +39,7 @@ class Main
|
|
39
39
|
def test_sanity
|
40
40
|
#create and configure auditing instance
|
41
41
|
myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION['auditing'] )
|
42
|
-
myauditing.
|
42
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
43
43
|
myauditing.service_identifier = 'my-test-service.com'
|
44
44
|
|
45
45
|
#associate a set of auditing entries with a flow by generating a flow identifiers
|
data/sanity/sanity_benchmark.rb
CHANGED
@@ -44,7 +44,7 @@ class Main
|
|
44
44
|
|
45
45
|
#create and configure auditing instance
|
46
46
|
myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION['auditing'] )
|
47
|
-
myauditing.
|
47
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
48
48
|
myauditing.service_identifier = 'my-test-service.com'
|
49
49
|
|
50
50
|
#associate a set of auditing entries with a flow by generating a flow identifiers
|
@@ -52,7 +52,7 @@ class Main
|
|
52
52
|
|
53
53
|
Benchmark.bm do |x|
|
54
54
|
myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION['auditing'].dup.merge("level" => "warn") )
|
55
|
-
myauditing.
|
55
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
56
56
|
myauditing.service_identifier = 'my-test-service.com'
|
57
57
|
x.report ("audit_call_below_audit_threshold:") {
|
58
58
|
iterations.times {
|
@@ -60,7 +60,7 @@ class Main
|
|
60
60
|
}
|
61
61
|
}
|
62
62
|
myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION['auditing'].dup.merge("add_caller_source_location" => "false") )
|
63
|
-
myauditing.
|
63
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
64
64
|
myauditing.service_identifier = 'my-test-service.com'
|
65
65
|
x.report ("audit_call_without_caller_info :") {
|
66
66
|
iterations.times {
|
@@ -68,7 +68,7 @@ class Main
|
|
68
68
|
}
|
69
69
|
}
|
70
70
|
myauditing = SoarAuditingProvider::AuditingProvider.new( AUDITING_CONFIGURATION['auditing'].dup.merge("add_caller_source_location" => "true") )
|
71
|
-
myauditing.
|
71
|
+
myauditing.startup_flow_id = SoarFlow::ID::generate_flow_id
|
72
72
|
myauditing.service_identifier = 'my-test-service.com'
|
73
73
|
x.report ("audit_call_with_caller_info :") {
|
74
74
|
iterations.times {
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: soar_auditing_provider
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.1.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Ernst van Graan
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: exe
|
11
11
|
cert_chain: []
|
12
|
-
date: 2016-
|
12
|
+
date: 2016-09-14 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: bundler
|