mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-07 01:32:47 +01:00
change how telegraf script determine if there is already and instance of the script already running
This commit is contained in:
m0duspwnens
@@ -15,9 +15,8 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
PREVCOUNTFILE='/tmp/beatseps.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:5066/stats | jq '.libbeat.output.events.acked')"
|
||||
@@ -42,7 +41,6 @@ if [ ! "$THEGREP" ]; then
|
||||
echo "fbstats eps=${EVENTS%%.*},failed=$FAILEDEVENTCOUNT"
|
||||
fi
|
||||
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,13 +15,12 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
FILES=$(ls -1x /host/nsm/strelka/unprocessed | wc -l)
|
||||
|
||||
echo "faffiles files=$FILES"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,9 +15,8 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
PREVCOUNTFILE='/tmp/eps.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.events.in')"
|
||||
@@ -40,7 +39,7 @@ if [ ! "$THEGREP" ]; then
|
||||
|
||||
echo "consumptioneps eps=${EVENTS%%.*}"
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,9 +15,8 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
PREVCOUNTFILE='/tmp/helixevents.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.helix.events.out')"
|
||||
@@ -39,6 +38,7 @@ if [ ! "$THEGREP" ]; then
|
||||
|
||||
echo "helixeps eps=${EVENTS%%.*}"
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,13 +15,12 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
INFLUXSIZE=$(du -s -k /host/nsm/influxdb | awk {'print $1'})
|
||||
|
||||
echo "influxsize kbytes=$INFLUXSIZE"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,9 +15,8 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
# Get the data
|
||||
OLDPCAP=$(find /host/nsm/pcap -type f -exec stat -c'%n %Z' {} + | sort | grep -v "\." | head -n 1 | awk {'print $2'})
|
||||
@@ -25,6 +24,7 @@ if [ ! "$THEGREP" ]; then
|
||||
AGE=$(($DATE - $OLDPCAP))
|
||||
|
||||
echo "pcapage seconds=$AGE"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,17 +15,18 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
RAIDLOG=/var/log/raid/status.log
|
||||
RAIDSTATUS=$(cat /var/log/raid/status.log)
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
RAIDLOG=/var/log/raid/status.log
|
||||
RAIDSTATUS=$(cat /var/log/raid/status.log)
|
||||
|
||||
if [ -f "$RAIDLOG" ]; then
|
||||
echo "raid $RAIDSTATUS"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,14 +15,14 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
UNPARSED=$(redis-cli llen logstash:unparsed | awk '{print $1}')
|
||||
PARSED=$(redis-cli llen logstash:parsed | awk '{print $1}')
|
||||
|
||||
echo "redisqueue unparsed=$UNPARSED,parsed=$PARSED"
|
||||
else
|
||||
exit 0
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -14,9 +14,9 @@
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
SOSTATUSLOG=/var/log/sostatus/status.log
|
||||
SOSTATUSSTATUS=$(cat /var/log/sostatus/status.log)
|
||||
@@ -26,6 +26,7 @@ if [ ! "$THEGREP" ]; then
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,9 +15,8 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
CHECKIT=$(grep "Thread 0" /var/log/stenographer/stenographer.log |tac |head -2|wc -l)
|
||||
STENOGREP=$(grep "Thread 0" /var/log/stenographer/stenographer.log |tac |head -2)
|
||||
@@ -42,7 +41,7 @@ if [ ! "$THEGREP" ]; then
|
||||
echo "stenodrop drop=$LOSS"
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -16,9 +16,8 @@
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
SURILOG=$(tac /var/log/suricata/stats.log | grep kernel | head -4)
|
||||
CHECKIT=$(echo $SURILOG | grep -o 'drop' | wc -l)
|
||||
@@ -43,6 +42,7 @@ if [ ! "$THEGREP" ]; then
|
||||
echo "suridrop drop=$LOSS"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "suridrop drop=0"
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -18,9 +18,8 @@
|
||||
|
||||
# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
if [ -d "/host/nsm/zeek/spool/logger" ]; then
|
||||
WORKERS={{ salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) }}
|
||||
@@ -45,6 +44,7 @@ if [ ! "$THEGREP" ]; then
|
||||
fi
|
||||
echo "$CURRENTTS" > $LASTCAPTURELOSSLOG
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -17,9 +17,8 @@
|
||||
|
||||
# This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ ! "$THEGREP" ]; then
|
||||
# if this script isn't already running
|
||||
if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then
|
||||
|
||||
ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
|
||||
declare RESULT=($ZEEKLOG)
|
||||
@@ -43,6 +42,7 @@ if [ ! "$THEGREP" ]; then
|
||||
LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
|
||||
echo "zeekdrop drop=$LOSS"
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
Reference in New Issue
Block a user