CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-22 17:03:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

set timestamp with capture loss

Browse Source
This commit is contained in:
m0duspwnens
2020-10-07 10:20:51 -04:00
parent 14dd80b410
commit 5e534571ff
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/telegraf/scripts/zeekcaptureloss.sh
View File

@@ -1,7 +1,10 @@
#!/bin/bash #!/bin/bash
# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp
{%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %} {%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %}
ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log
if [ -f "$ZEEKLOG" ]; then if [ -f "$ZEEKLOG" ]; then
LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print LOSS}') LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print LOSS}')
echo "zeekcaptureloss loss=$LOSS" TS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g')
TSNANO=$(echo "$(date -d "$TS" +"%s.%N") 1000000000 * p" | dc | awk -F. {'print $1'})
echo "zeekcaptureloss loss=$LOSS $TSNANO"
fi fi

1
salt/telegraf/scripts/zeekloss.sh
View File

@@ -1,4 +1,5 @@
#!/bin/bash #!/bin/bash
# This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage
ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2) ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
declare RESULT=($ZEEKLOG) declare RESULT=($ZEEKLOG)
CURRENTDROP=${RESULT[3]} CURRENTDROP=${RESULT[3]}