CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change EPS for Telegraf

Browse Source
This commit is contained in:
Mike Reeves
2021-04-19 13:29:46 -04:00
parent 54322f5e9d
commit 0c0edbaac8
13 changed files with 25 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/telegraf/scripts/beatseps.sh
View File

@@ -15,7 +15,7 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! "$THEGREP" ]; then if [ ! "$THEGREP" ]; then

4
salt/telegraf/scripts/checkfiles.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
FILES=$(ls -1x /host/nsm/faf/complete/ | wc -l) FILES=$(ls -1x /host/nsm/faf/complete/ | wc -l)

4
salt/telegraf/scripts/eps.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
PREVCOUNTFILE='/tmp/eps.txt' PREVCOUNTFILE='/tmp/eps.txt'
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.events.in')" EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.events.in')"

4
salt/telegraf/scripts/helixeps.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
PREVCOUNTFILE='/tmp/helixevents.txt' PREVCOUNTFILE='/tmp/helixevents.txt'
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.helix.events.out')" EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.helix.events.out')"

4
salt/telegraf/scripts/influxdbsize.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
INFLUXSIZE=$(du -s -k /host/nsm/influxdb | awk {'print $1'}) INFLUXSIZE=$(du -s -k /host/nsm/influxdb | awk {'print $1'})

4
salt/telegraf/scripts/oldpcap.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
# Get the data # Get the data
OLDPCAP=$(find /host/nsm/pcap -type f -exec stat -c'%n %Z' {} + | sort | grep -v "\." | head -n 1 | awk {'print $2'}) OLDPCAP=$(find /host/nsm/pcap -type f -exec stat -c'%n %Z' {} + | sort | grep -v "\." | head -n 1 | awk {'print $2'})

4
salt/telegraf/scripts/raid.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
if [ -f "$RAIDLOG" ]; then if [ -f "$RAIDLOG" ]; then
echo "raid $RAIDSTATUS" echo "raid $RAIDSTATUS"

5
salt/telegraf/scripts/redis.sh
View File

@@ -15,10 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
THEGREP=$(ps -ef | grep $0 | grep -v grep) if [ ! "$THEGREP" ]; then
if [ ! $THEGREP ]; then
UNPARSED=$(redis-cli llen logstash:unparsed | awk '{print $1}') UNPARSED=$(redis-cli llen logstash:unparsed | awk '{print $1}')
PARSED=$(redis-cli llen logstash:parsed | awk '{print $1}') PARSED=$(redis-cli llen logstash:parsed | awk '{print $1}')

4
salt/telegraf/scripts/sostatus.sh
View File

@@ -14,9 +14,9 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
SOSTATUSLOG=/var/log/sostatus/status.log SOSTATUSLOG=/var/log/sostatus/status.log
SOSTATUSSTATUS=$(cat /var/log/sostatus/status.log) SOSTATUSSTATUS=$(cat /var/log/sostatus/status.log)

4
salt/telegraf/scripts/stenoloss.sh
View File

@@ -15,9 +15,9 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
TSFILE=/var/log/telegraf/laststenodrop.log TSFILE=/var/log/telegraf/laststenodrop.log
if [ -f "$TSFILE" ]; then if [ -f "$TSFILE" ]; then

4
salt/telegraf/scripts/suriloss.sh
View File

@@ -16,9 +16,9 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
SURILOG=$(tac /var/log/suricata/stats.log | grep kernel | head -4) SURILOG=$(tac /var/log/suricata/stats.log | grep kernel | head -4)
CHECKIT=$(echo $SURILOG | grep -o 'drop' | wc -l) CHECKIT=$(echo $SURILOG | grep -o 'drop' | wc -l)

4
salt/telegraf/scripts/zeekcaptureloss.sh
View File

@@ -18,9 +18,9 @@
# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp # This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
if [ -d "/host/nsm/zeek/spool/logger" ]; then if [ -d "/host/nsm/zeek/spool/logger" ]; then
WORKERS={{ salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) }} WORKERS={{ salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) }}

4
salt/telegraf/scripts/zeekloss.sh
View File

@@ -17,9 +17,9 @@
# This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage # This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage
THEGREP=$(ps -ef | grep $0 | grep -v grep) THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
if [ ! $THEGREP ]; then if [ ! "$THEGREP" ]; then
ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2) ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
declare RESULT=($ZEEKLOG) declare RESULT=($ZEEKLOG)