From be6933e8fb80536be70bbf12697bbfeb958c6085 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 19 Apr 2021 14:20:00 -0400
Subject: [PATCH] Change EPS for Telegraf

---
 salt/telegraf/scripts/checkfiles.sh      | 2 +-
 salt/telegraf/scripts/eps.sh             | 2 +-
 salt/telegraf/scripts/helixeps.sh        | 1 +
 salt/telegraf/scripts/suriloss.sh        | 1 +
 salt/telegraf/scripts/zeekcaptureloss.sh | 1 +
 salt/telegraf/scripts/zeekloss.sh        | 1 +
 6 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/salt/telegraf/scripts/checkfiles.sh b/salt/telegraf/scripts/checkfiles.sh
index 1d7a44382..5c6ab56c1 100644
--- a/salt/telegraf/scripts/checkfiles.sh
+++ b/salt/telegraf/scripts/checkfiles.sh
@@ -19,7 +19,7 @@ THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
 
 if [ ! "$THEGREP" ]; then
 
-    FILES=$(ls -1x /host/nsm/faf/complete/ | wc -l)
+    FILES=$(ls -1x /host/nsm/strelka/unprocessed | wc -l)
 
     echo "faffiles files=$FILES"
 else
diff --git a/salt/telegraf/scripts/eps.sh b/salt/telegraf/scripts/eps.sh
index 25332e94a..b497c2519 100644
--- a/salt/telegraf/scripts/eps.sh
+++ b/salt/telegraf/scripts/eps.sh
@@ -39,7 +39,7 @@ if [ ! "$THEGREP" ]; then
       fi
 
       echo "consumptioneps eps=${EVENTS%%.*}"
-
+    fi
 else
     exit 0
 fi
diff --git a/salt/telegraf/scripts/helixeps.sh b/salt/telegraf/scripts/helixeps.sh
index d24f1d1e7..1411cc40b 100644
--- a/salt/telegraf/scripts/helixeps.sh
+++ b/salt/telegraf/scripts/helixeps.sh
@@ -38,6 +38,7 @@ if [ ! "$THEGREP" ]; then
     fi
 
     echo "helixeps eps=${EVENTS%%.*}"
+  fi
 else
     exit 0
 fi
\ No newline at end of file
diff --git a/salt/telegraf/scripts/suriloss.sh b/salt/telegraf/scripts/suriloss.sh
index 1f43fbaf8..2d0a56106 100644
--- a/salt/telegraf/scripts/suriloss.sh
+++ b/salt/telegraf/scripts/suriloss.sh
@@ -42,6 +42,7 @@ if [ ! "$THEGREP" ]; then
         LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
         echo "suridrop drop=$LOSS"
       fi
+    fi
 else
   echo "suridrop drop=0"
 fi
\ No newline at end of file
diff --git a/salt/telegraf/scripts/zeekcaptureloss.sh b/salt/telegraf/scripts/zeekcaptureloss.sh
index 03c9188ea..6cb2dd2e2 100644
--- a/salt/telegraf/scripts/zeekcaptureloss.sh
+++ b/salt/telegraf/scripts/zeekcaptureloss.sh
@@ -44,6 +44,7 @@ if [ ! "$THEGREP" ]; then
         fi
       fi
       echo "$CURRENTTS" > $LASTCAPTURELOSSLOG
+    fi
 else
     exit 0
 fi
diff --git a/salt/telegraf/scripts/zeekloss.sh b/salt/telegraf/scripts/zeekloss.sh
index c9bc843cf..3dbd42833 100644
--- a/salt/telegraf/scripts/zeekloss.sh
+++ b/salt/telegraf/scripts/zeekloss.sh
@@ -42,6 +42,7 @@ if [ ! "$THEGREP" ]; then
     TOTAL=$((CURRENTPACKETS - PASTPACKETS))
     LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
     echo "zeekdrop drop=$LOSS"
+  fi
 else
   exit 0
 fi
\ No newline at end of file