CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/2.4/dev' into vlb2

Browse Source
This commit is contained in:
Josh Patterson
2025-04-24 09:41:27 -04:00
parent ed80c4e13b 46779513de
commit 142609ea67
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/influxdb/templates/alarm_nsm_disk.json
View File

@@ -5,10 +5,10 @@
"name": "alarm-nsm-disk" "name": "alarm-nsm-disk"
}, },
"spec": { "spec": {
"description": "Percent used space on the root partition of at least one node has exceeded the alarm threshold.", "description": "Percent used space on the nsm partition of at least one node has exceeded the alarm threshold.",
"every": "1m0s", "every": "1m0s",
"name": "NSM Disk High Usage", "name": "NSM Disk High Usage",
"query": "from(bucket: \"telegraf/so_short_term\")\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n |> filter(fn: (r) => r[\"_measurement\"] == \"disk\")\n |> filter(fn: (r) => r[\"path\"] == \"/\")\n |> filter(fn: (r) => r[\"_field\"] == \"used_percent\")\n |> aggregateWindow(every: 1m, fn: max, createEmpty: false)\n |> yield(name: \"max\")", "query": "from(bucket: \"telegraf/so_short_term\")\n |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n |> filter(fn: (r) => r[\"_measurement\"] == \"disk\")\n |> filter(fn: (r) => r[\"path\"] == \"/nsm\")\n |> filter(fn: (r) => r[\"_field\"] == \"used_percent\")\n |> aggregateWindow(every: 1m, fn: max, createEmpty: false)\n |> yield(name: \"max\")",
"status": "active", "status": "active",
"statusMessageTemplate": "Check: ${ r._check_name } is: ${ r._level }", "statusMessageTemplate": "Check: ${ r._check_name } is: ${ r._level }",
"thresholds": [ "thresholds": [

3
salt/telegraf/enabled.sls
View File

@@ -20,7 +20,6 @@ so-telegraf:
- user: 939 - user: 939
- group_add: 939,920 - group_add: 939,920
- environment: - environment:
- HOST_PROC=/host/proc
- HOST_ETC=/host/etc - HOST_ETC=/host/etc
- HOST_SYS=/host/sys - HOST_SYS=/host/sys
- HOST_MOUNT_PREFIX=/host - HOST_MOUNT_PREFIX=/host
@@ -38,7 +37,7 @@ so-telegraf:
- /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro - /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro
- /var/run/utmp:/var/run/utmp:ro - /var/run/utmp:/var/run/utmp:ro
- /var/run/docker.sock:/var/run/docker.sock:ro - /var/run/docker.sock:/var/run/docker.sock:ro
- /:/host/root:ro - /:/host:ro
- /sys:/host/sys:ro - /sys:/host/sys:ro
- /proc:/host/proc:ro - /proc:/host/proc:ro
- /nsm:/host/nsm:ro - /nsm:/host/nsm:ro

8
salt/telegraf/etc/telegraf.conf
View File

@@ -113,7 +113,13 @@
[[inputs.disk]] [[inputs.disk]]
## By default stats will be gathered for all mount points. ## By default stats will be gathered for all mount points.
## Set mount_points will restrict the stats to only the specified mount points. ## Set mount_points will restrict the stats to only the specified mount points.
#mount_points = ["/", "/host/nsm"] mount_points = ["/host",
"/host/nsm",
"/host/var",
"/host/var/log",
"/host/var/log/audit",
"/host/var/tmp"
]
## Ignore mount points by filesystem type. ## Ignore mount points by filesystem type.
#ignore_fs = ["tmpfs", "devtmpfs", "devfs", "overlay", "aufs", "squashfs"] #ignore_fs = ["tmpfs", "devtmpfs", "devfs", "overlay", "aufs", "squashfs"]