CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5086 from Security-Onion-Solutions/foxtrot

Browse Source 
Add conditional check for logscan log + add log folder to logrotate config
This commit is contained in:
William Wernert
2021-08-06 11:32:23 -04:00
committed by GitHub
parent 768e61e11a 26030d83eb
commit b12e2eded5
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/common/files/log-rotate.conf
View File

@@ -22,6 +22,7 @@
/opt/so/log/salt/so-salt-minion-check /opt/so/log/salt/so-salt-minion-check
/opt/so/log/salt/minion /opt/so/log/salt/minion
/opt/so/log/salt/master /opt/so/log/salt/master
/opt/so/log/logscan/*.log
{ {
{{ logrotate_conf | indent(width=4) }} {{ logrotate_conf | indent(width=4) }}
} }

2
salt/filebeat/etc/filebeat.yml
View File

@@ -112,6 +112,7 @@ filebeat.inputs:
fields: ["source", "prospector", "input", "offset", "beat"] fields: ["source", "prospector", "input", "offset", "beat"]
fields_under_root: true fields_under_root: true
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-manager', 'so-managersearch', 'so-import'] %}
- type: log - type: log
paths: paths:
- /logs/logscan/alerts.log - /logs/logscan/alerts.log
@@ -124,6 +125,7 @@ filebeat.inputs:
fields_under_root: true fields_under_root: true
clean_removed: true clean_removed: true
close_removed: false close_removed: false
{%- endif %}
{%- if grains['role'] in ['so-eval', 'so-standalone', 'so-sensor', 'so-helix', 'so-heavynode', 'so-import'] %} {%- if grains['role'] in ['so-eval', 'so-standalone', 'so-sensor', 'so-helix', 'so-heavynode', 'so-import'] %}
{%- if ZEEKVER != 'SURICATA' %} {%- if ZEEKVER != 'SURICATA' %}