[wip] Add logscan state

Do not add state to top file or setup yet, script will be written to enable the feature shortly

salt/allowed_states.map.jinja

@@ -45,7 +45,8 @@
           'schedule',
           'soctopus',
           'tcpreplay',
-          'docker_clean'
+          'docker_clean',
+          'logscsan'
           ],
       'so-heavynode': [
           'ca',
@@ -75,7 +76,8 @@
           'logstash',
           'schedule',
           'tcpreplay',
-          'docker_clean'
+          'docker_clean',
+          'logscsan'
           ],
       'so-fleet': [
           'ca',
@@ -108,7 +110,8 @@
           'zeek',
           'schedule',
           'tcpreplay',
-          'docker_clean'
+          'docker_clean',
+          'logscsan'
           ],
       'so-manager': [
           'salt.master',
@@ -127,7 +130,8 @@
           'utility',
           'schedule',
           'soctopus',
-          'docker_clean'
+          'docker_clean',
+          'logscsan'
           ],
       'so-managersearch': [
           'salt.master',
@@ -146,7 +150,8 @@
           'utility',
           'schedule',
           'soctopus',
-          'docker_clean'
+          'docker_clean',
+          'logscsan'
           ],
       'so-node': [
           'ca',
@@ -178,7 +183,8 @@
           'schedule',
           'soctopus',
           'tcpreplay',
-          'docker_clean'
+          'docker_clean',
+          'logscsan'
           ],
       'so-sensor': [
           'ca',

salt/logscan/files/logscan.conf

@@ -0,0 +1,6 @@
+[global]
+ts_format = iso8601
+scan_interval = 30s
+
+[kratos]
+log_path = kratos/kratos.log

salt/logscan/init.sls

@@ -0,0 +1,57 @@
+{% from 'allowed_states.map.jinja' import allowed_states %}
+{% if sls in allowed_states %}
+
+{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
+{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
+{% set MANAGER = salt['grains.get']('master') %}
+{% set logscan_cpu_period = salt['pillar.get']('logscan:cpu_period', 10000) %}
+
+logscan_data_dir:
+  file.directory:
+    - name: /nsm/logscan/data
+    - user: 939
+    - group: 939
+    - makedirs: True
+
+logscan_conf_dir:
+  file.directory:
+    - name: /opt/so/conf/logscan
+    - user: 939
+    - group: 939
+    - makedirs: True
+
+logscan_conf:
+  file.managed:
+    - name: /opt/so/conf/logscan/logscan.conf
+    - source: salt://logscan/files/logscan.conf
+    - user: 939
+    - group: 939
+    - mode: 600
+    - template: jinja
+
+logscan_log_dir:
+  file.directory:
+    - name: /opt/so/log/logscan
+    - user: 939
+    - group: 939
+
+so-logscan:
+  docker_container.running:
+    - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-logscan:{{ VERSION }}
+    - hostname: logscan
+    - name: so-logscan
+    - binds:
+      - /nsm/logscan/data:/logscan/data:rw
+      - /opt/so/conf/logscan.conf:/logscan/logscan.conf:ro
+      - /opt/so/log/logscan:/logscan/output:rw
+      - /opt/so/log:/logscan/logs:ro
+    - cpu_period: {{ logscan_cpu_period }}
+    
+
+{% else %}
+
+{{sls}}_state_not_allowed:
+  test.fail_without_changes:
+    - name: {{sls}}_state_not_allowed
+
+{% endif %}