CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

disable zeekpacketlosscron and telegraf checks if zeek is diabled via pillar

Browse Source
This commit is contained in:
m0duspwnens
2021-10-28 07:46:02 -04:00
parent b3e5319806
commit 18ce9c7819
3 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/zeek/init.sls
View File

@@ -146,7 +146,7 @@ plcronscript:
- mode: 755
zeekpacketlosscron:
cron.present:
cron.{{ZEEKOPTIONS.pl_cron_state}}:
- name: /usr/local/bin/packetloss.sh
- user: root
- minute: '*/10'

4
salt/zeek/map.jinja
View File

@@ -4,12 +4,14 @@
# don't start the docker container if it is an import node or disabled via pillar
{% if grains.id.split('_')|last == 'import' or ENABLED is sameas false %}
{% do ZEEKOPTIONS.update({'start': False}) %}
{% do ZEEKOPTIONS.update({'pl_cron_state': 'absent'}) %}
{% else %}
{% do ZEEKOPTIONS.update({'start': True}) %}
{% do ZEEKOPTIONS.update({'pl_cron_state': 'present'}) %}
{% endif %}
{% if ENABLED is sameas false %}
{% do ZEEKOPTIONS.update({'status': 'absent'}) %}
{% else %}
{% do ZEEKOPTIONS.update({'status': 'running'}) %}
{% endif %}
{% endif %}