CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add basic read-only metric collection from Kafka

Browse Source 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
This commit is contained in:
reyesj2
2024-05-08 16:13:09 -04:00
parent e960ae66a3
commit dff609d829
3 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/docker/defaults.yaml
View File

@@ -192,6 +192,7 @@ docker:
port_bindings: port_bindings:
- 0.0.0.0:9092:9092 - 0.0.0.0:9092:9092
- 0.0.0.0:9093:9093 - 0.0.0.0:9093:9093
- 0.0.0.0:8778:8778
custom_bind_mounts: [] custom_bind_mounts: []
extra_hosts: [] extra_hosts: []
extra_env: [] extra_env: []

9
salt/kafka/enabled.sls
View File

@@ -25,7 +25,8 @@ so-kafka:
- ipv4_address: {{ DOCKER.containers['so-kafka'].ip }} - ipv4_address: {{ DOCKER.containers['so-kafka'].ip }}
- user: kafka - user: kafka
- environment: - environment:
- KAFKA_HEAP_OPTS=-Xmx2G -Xms1G KAFKA_HEAP_OPTS: -Xmx2G -Xms1G
KAFKA_OPTS: -javaagent:/jolokia/agents/jolokia-agent-jvm-javaagent.jar=port=8778,host={{ DOCKER.containers['so-kafka'].ip }},policyLocation=file:/jolokia/jolokia.xml
- extra_hosts: - extra_hosts:
{% for node in KAFKANODES %} {% for node in KAFKANODES %}
- {{ node }}:{{ KAFKANODES[node].ip }} - {{ node }}:{{ KAFKANODES[node].ip }}
@@ -40,10 +41,10 @@ so-kafka:
- {{ BINDING }} - {{ BINDING }}
{% endfor %} {% endfor %}
- binds: - binds:
- /etc/pki/kafka.p12:/etc/pki/kafka.p12 - /etc/pki/kafka.p12:/etc/pki/kafka.p12:ro
- /opt/so/conf/ca/cacerts:/etc/pki/java/sos/cacerts - /opt/so/conf/ca/cacerts:/etc/pki/java/sos/cacerts:ro
- /nsm/kafka/data/:/nsm/kafka/data/:rw - /nsm/kafka/data/:/nsm/kafka/data/:rw
- /opt/so/conf/kafka/server.properties:/kafka/config/kraft/server.properties - /opt/so/conf/kafka/server.properties:/kafka/config/kraft/server.properties:ro
{% if GLOBALS.is_manager %} {% if GLOBALS.is_manager %}
- /opt/so/conf/kafka/client.properties:/kafka/config/kraft/client.properties - /opt/so/conf/kafka/client.properties:/kafka/config/kraft/client.properties
{% endif %} {% endif %}

17
salt/telegraf/etc/telegraf.conf
View File

@@ -243,6 +243,23 @@
password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass') }}" password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass') }}"
{%- endif %} {%- endif %}
{% if grains.role in ['so-manager','so-managersearch','so-standalone','so-receiver'] -%}
[[inputs.jolokia2_agent]]
name_prefix= "kafka_"
urls = ["http://localhost:8778/jolokia"]
[[inputs.jolokia2_agent.metric]]
name = "topics"
mbean = "kafka.server:name=*,type=BrokerTopicMetrics"
field_prefix = "$1."
[[inputs.jolokia2_agent.metric]]
name = "topic"
mbean = "kafka.server:name=*,topic=*,type=BrokerTopicMetrics"
field_prefix = "$1."
tag_keys = ["topic"]
{%- endif %}
# # Read metrics from one or more commands that can output to stdout # # Read metrics from one or more commands that can output to stdout
{%- if 'sostatus.sh' in TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] %} {%- if 'sostatus.sh' in TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] %}
{%- do TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]].remove('sostatus.sh') %} {%- do TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]].remove('sostatus.sh') %}