mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Merge pull request #3912 from Security-Onion-Solutions/telefix1
Change telegraf scripts to new method of process detection
This commit is contained in:
Mike Reeves
GitHub
@@ -17,6 +17,7 @@
|
||||
{% set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
|
||||
{% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
|
||||
{% set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}
|
||||
{%- set TRUE_CLUSTER = salt['pillar.get']('elasticsearch:true_cluster', False) %}
|
||||
|
||||
# Global tags can be specified here in key="value" format.
|
||||
[global_tags]
|
||||
@@ -614,18 +615,29 @@
|
||||
# ## Use TLS but skip chain & host verification
|
||||
# # insecure_skip_verify = false
|
||||
|
||||
{% if TRUE_CLUSTER %}
|
||||
{% if grains.role == 'so-manager' %}
|
||||
[[inputs.elasticsearch]]
|
||||
servers = ["https://{{ MANAGER }}:9200"]
|
||||
insecure_skip_verify = true
|
||||
local = false
|
||||
cluster_health = true
|
||||
cluster_stats = true
|
||||
{% endif %}
|
||||
|
||||
{% else %}
|
||||
|
||||
# # Read stats from one or more Elasticsearch servers or clusters
|
||||
{% if grains['role'] in ['so-manager', 'so-eval', 'so-managersearch', 'so-standalone'] %}
|
||||
{% if grains['role'] in ['so-manager', 'so-eval', 'so-managersearch', 'so-standalone'] %}
|
||||
[[inputs.elasticsearch]]
|
||||
servers = ["https://{{ MANAGER }}:9200"]
|
||||
insecure_skip_verify = true
|
||||
{% elif grains['role'] in ['so-node', 'so-hotnode', 'so-warmnode', 'so-heavynode'] %}
|
||||
{% elif grains['role'] in ['so-node', 'so-hotnode', 'so-warmnode', 'so-heavynode'] %}
|
||||
[[inputs.elasticsearch]]
|
||||
servers = ["https://{{ NODEIP }}:9200"]
|
||||
insecure_skip_verify = true
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
#
|
||||
# ## Timeout for HTTP requests to the elastic search server(s)
|
||||
# http_timeout = "5s"
|
||||
@@ -673,11 +685,32 @@
|
||||
|
||||
|
||||
# ## Commands array
|
||||
{% if grains['role'] in ['so-manager', 'so-managersearch'] %}
|
||||
{% if grains['role'] in ['so-manager'] %}
|
||||
[[inputs.exec]]
|
||||
commands = [
|
||||
"/scripts/redis.sh",
|
||||
"/scripts/influxdbsize.sh",
|
||||
"/scripts/raid.sh",
|
||||
"/scripts/beatseps.sh"
|
||||
]
|
||||
data_format = "influx"
|
||||
## Timeout for each command to complete.
|
||||
timeout = "15s"
|
||||
{% elif grains['role'] in ['so-managersearch'] %}
|
||||
[[inputs.exec]]
|
||||
commands = [
|
||||
"/scripts/redis.sh",
|
||||
"/scripts/influxdbsize.sh",
|
||||
"/scripts/eps.sh",
|
||||
"/scripts/raid.sh",
|
||||
"/scripts/beatseps.sh"
|
||||
]
|
||||
data_format = "influx"
|
||||
## Timeout for each command to complete.
|
||||
timeout = "15s"
|
||||
{% elif grains['role'] in ['so-node'] %}
|
||||
[[inputs.exec]]
|
||||
commands = [
|
||||
"/scripts/eps.sh",
|
||||
"/scripts/raid.sh",
|
||||
"/scripts/beatseps.sh"
|
||||
|
||||
@@ -15,37 +15,34 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=beatseps
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
PREVCOUNTFILE='/tmp/beatseps.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:5066/stats | jq '.libbeat.output.events.acked')"
|
||||
FAILEDEVENTCOUNT="$(curl -s localhost:5066/stats | jq '.libbeat.output.events.failed')"
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
if [ ! -z "$EVENTCOUNTCURRENT" ]; then
|
||||
PREVCOUNTFILE='/tmp/beatseps.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:5066/stats | jq '.libbeat.output.events.acked')"
|
||||
FAILEDEVENTCOUNT="$(curl -s localhost:5066/stats | jq '.libbeat.output.events.failed')"
|
||||
|
||||
if [ ! -z "$EVENTCOUNTCURRENT" ]; then
|
||||
|
||||
if [ -f "$PREVCOUNTFILE" ]; then
|
||||
EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
|
||||
else
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -f "$PREVCOUNTFILE" ]; then
|
||||
EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
|
||||
else
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
# the division by 30 is because the agent interval is 30 seconds
|
||||
EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30))
|
||||
if [ "$EVENTS" -lt 0 ]; then
|
||||
EVENTS=0
|
||||
fi
|
||||
|
||||
echo "fbstats eps=${EVENTS%%.*},failed=$FAILEDEVENTCOUNT"
|
||||
fi
|
||||
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
# the division by 30 is because the agent interval is 30 seconds
|
||||
EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30))
|
||||
if [ "$EVENTS" -lt 0 ]; then
|
||||
EVENTS=0
|
||||
fi
|
||||
|
||||
echo "fbstats eps=${EVENTS%%.*},failed=$FAILEDEVENTCOUNT"
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,15 +15,13 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=checkfiles
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
FILES=$(ls -1x /host/nsm/faf/complete/ | wc -l)
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
echo "faffiles files=$FILES"
|
||||
FILES=$(ls -1x /host/nsm/strelka/unprocessed | wc -l)
|
||||
|
||||
echo "faffiles files=$FILES"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
@@ -15,36 +15,32 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=eps
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
PREVCOUNTFILE='/tmp/eps.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.events.in')"
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
if [ ! -z "$EVENTCOUNTCURRENT" ]; then
|
||||
PREVCOUNTFILE='/tmp/eps.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.events.in')"
|
||||
|
||||
if [ -f "$PREVCOUNTFILE" ]; then
|
||||
EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
|
||||
else
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
if [ ! -z "$EVENTCOUNTCURRENT" ]; then
|
||||
|
||||
if [ -f "$PREVCOUNTFILE" ]; then
|
||||
EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
|
||||
else
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
# the division by 30 is because the agent interval is 30 seconds
|
||||
EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30))
|
||||
if [ "$EVENTS" -lt 0 ]; then
|
||||
EVENTS=0
|
||||
fi
|
||||
|
||||
echo "consumptioneps eps=${EVENTS%%.*}"
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
# the division by 30 is because the agent interval is 30 seconds
|
||||
EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30))
|
||||
if [ "$EVENTS" -lt 0 ]; then
|
||||
EVENTS=0
|
||||
fi
|
||||
|
||||
echo "esteps eps=${EVENTS%%.*}"
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,35 +15,30 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=helixeps
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
PREVCOUNTFILE='/tmp/helixevents.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.helix.events.out')"
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
if [ ! -z "$EVENTCOUNTCURRENT" ]; then
|
||||
PREVCOUNTFILE='/tmp/helixevents.txt'
|
||||
EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.helix.events.out')"
|
||||
|
||||
if [ ! -z "$EVENTCOUNTCURRENT" ]; then
|
||||
|
||||
if [ -f "$PREVCOUNTFILE" ]; then
|
||||
EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
|
||||
else
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -f "$PREVCOUNTFILE" ]; then
|
||||
EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
|
||||
else
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30))
|
||||
if [ "$EVENTS" -lt 0 ]; then
|
||||
EVENTS=0
|
||||
fi
|
||||
|
||||
echo "helixeps eps=${EVENTS%%.*}"
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
|
||||
EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30))
|
||||
if [ "$EVENTS" -lt 0 ]; then
|
||||
EVENTS=0
|
||||
fi
|
||||
|
||||
echo "helixeps eps=${EVENTS%%.*}"
|
||||
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
@@ -15,15 +15,13 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=influxsize
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
INFLUXSIZE=$(du -s -k /host/nsm/influxdb | awk {'print $1'})
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
echo "influxsize kbytes=$INFLUXSIZE"
|
||||
INFLUXSIZE=$(du -s -k /host/nsm/influxdb | awk {'print $1'})
|
||||
|
||||
echo "influxsize kbytes=$INFLUXSIZE"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
@@ -15,18 +15,16 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=oldpcap
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
# Get the data
|
||||
OLDPCAP=$(find /host/nsm/pcap -type f -exec stat -c'%n %Z' {} + | sort | grep -v "\." | head -n 1 | awk {'print $2'})
|
||||
DATE=$(date +%s)
|
||||
AGE=$(($DATE - $OLDPCAP))
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
echo "pcapage seconds=$AGE"
|
||||
# Get the data
|
||||
OLDPCAP=$(find /host/nsm/pcap -type f -exec stat -c'%n %Z' {} + | sort | grep -v "\." | head -n 1 | awk {'print $2'})
|
||||
DATE=$(date +%s)
|
||||
AGE=$(($DATE - $OLDPCAP))
|
||||
|
||||
echo "pcapage seconds=$AGE"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
@@ -15,19 +15,15 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=raid
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
RAIDLOG=/var/log/raid/status.log
|
||||
RAIDSTATUS=$(cat /var/log/raid/status.log)
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ -f "$RAIDLOG" ]; then
|
||||
echo "raid $RAIDSTATUS"
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
if [ -f "$RAIDLOG" ]; then
|
||||
echo "raid $RAIDSTATUS"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -15,17 +15,14 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
APP=redis
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
UNPARSED=$(redis-cli llen logstash:unparsed | awk '{print $1}')
|
||||
PARSED=$(redis-cli llen logstash:parsed | awk '{print $1}')
|
||||
UNPARSED=$(redis-cli llen logstash:unparsed | awk '{print $1}')
|
||||
PARSED=$(redis-cli llen logstash:parsed | awk '{print $1}')
|
||||
|
||||
echo "redisqueue unparsed=$UNPARSED,parsed=$PARSED"
|
||||
echo "redisqueue unparsed=$UNPARSED,parsed=$PARSED"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -14,20 +14,18 @@
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
APP=sostatus
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
SOSTATUSLOG=/var/log/sostatus/status.log
|
||||
SOSTATUSSTATUS=$(cat /var/log/sostatus/status.log)
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
if [ -f "$SOSTATUSLOG" ]; then
|
||||
echo "sostatus status=$SOSTATUSSTATUS"
|
||||
SOSTATUSLOG=/var/log/sostatus/status.log
|
||||
SOSTATUSSTATUS=$(cat /var/log/sostatus/status.log)
|
||||
|
||||
if [ -f "$SOSTATUSLOG" ]; then
|
||||
echo "sostatus status=$SOSTATUSSTATUS"
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -15,31 +15,29 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
APP=stenoloss
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
TSFILE=/var/log/telegraf/laststenodrop.log
|
||||
if [ -f "$TSFILE" ]; then
|
||||
LASTTS=$(cat $TSFILE)
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
TSFILE=/var/log/telegraf/laststenodrop.log
|
||||
if [ -f "$TSFILE" ]; then
|
||||
LASTTS=$(cat $TSFILE)
|
||||
else
|
||||
LASTTS=0
|
||||
fi
|
||||
|
||||
# Get the data
|
||||
LOGLINE=$(tac /var/log/stenographer/stenographer.log | grep -m1 drop)
|
||||
CURRENTTS=$(echo $LOGLINE | awk '{print $1}')
|
||||
|
||||
if [[ "$CURRENTTS" != "$LASTTS" ]]; then
|
||||
DROP=$(echo $LOGLINE | awk '{print $14}' | awk -F "=" '{print $2}')
|
||||
echo $CURRENTTS > $TSFILE
|
||||
else
|
||||
DROP=0
|
||||
fi
|
||||
|
||||
echo "stenodrop drop=$DROP"
|
||||
else
|
||||
LASTTS=0
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Get the data
|
||||
LOGLINE=$(tac /var/log/stenographer/stenographer.log | grep -m1 drop)
|
||||
CURRENTTS=$(echo $LOGLINE | awk '{print $1}')
|
||||
|
||||
if [[ "$CURRENTTS" != "$LASTTS" ]]; then
|
||||
DROP=$(echo $LOGLINE | awk '{print $14}' | awk -F "=" '{print $2}')
|
||||
echo $CURRENTTS > $TSFILE
|
||||
else
|
||||
DROP=0
|
||||
fi
|
||||
|
||||
echo "stenodrop drop=$DROP"
|
||||
@@ -16,37 +16,33 @@
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
APP=suriloss
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
SURILOG=$(tac /var/log/suricata/stats.log | grep kernel | head -4)
|
||||
CHECKIT=$(echo $SURILOG | grep -o 'drop' | wc -l)
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
if [ $CHECKIT == 2 ]; then
|
||||
declare RESULT=($SURILOG)
|
||||
SURILOG=$(tac /var/log/suricata/stats.log | grep kernel | head -4)
|
||||
CHECKIT=$(echo $SURILOG | grep -o 'drop' | wc -l)
|
||||
|
||||
CURRENTDROP=${RESULT[4]}
|
||||
PASTDROP=${RESULT[14]}
|
||||
DROPPED=$((CURRENTDROP - PASTDROP))
|
||||
if [ $DROPPED == 0 ]; then
|
||||
LOSS=0
|
||||
echo "suridrop drop=0"
|
||||
else
|
||||
CURRENTPACKETS=${RESULT[9]}
|
||||
PASTPACKETS=${RESULT[19]}
|
||||
TOTALCURRENT=$((CURRENTPACKETS + CURRENTDROP))
|
||||
TOTALPAST=$((PASTPACKETS + PASTDROP))
|
||||
TOTAL=$((TOTALCURRENT - TOTALPAST))
|
||||
if [ $CHECKIT == 2 ]; then
|
||||
declare RESULT=($SURILOG)
|
||||
|
||||
LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
|
||||
echo "suridrop drop=$LOSS"
|
||||
fi
|
||||
CURRENTDROP=${RESULT[4]}
|
||||
PASTDROP=${RESULT[14]}
|
||||
DROPPED=$((CURRENTDROP - PASTDROP))
|
||||
if [ $DROPPED == 0 ]; then
|
||||
LOSS=0
|
||||
echo "suridrop drop=0"
|
||||
else
|
||||
CURRENTPACKETS=${RESULT[9]}
|
||||
PASTPACKETS=${RESULT[19]}
|
||||
TOTALCURRENT=$((CURRENTPACKETS + CURRENTDROP))
|
||||
TOTALPAST=$((PASTPACKETS + PASTDROP))
|
||||
TOTAL=$((TOTALCURRENT - TOTALPAST))
|
||||
|
||||
LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
|
||||
echo "suridrop drop=$LOSS"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "suridrop drop=0"
|
||||
fi
|
||||
@@ -18,35 +18,33 @@
|
||||
|
||||
# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp
|
||||
|
||||
APP=zeekcaploss
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
if [ -d "/host/nsm/zeek/spool/logger" ]; then
|
||||
WORKERS={{ salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) }}
|
||||
ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log
|
||||
elif [ -d "/host/nsm/zeek/spool/zeeksa" ]; then
|
||||
WORKERS=1
|
||||
ZEEKLOG=/host/nsm/zeek/spool/zeeksa/capture_loss.log
|
||||
else
|
||||
echo 'Zeek capture_loss.log not found' >/dev/stderr
|
||||
exit 2
|
||||
fi
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
LASTCAPTURELOSSLOG=/var/log/telegraf/lastcaptureloss.txt
|
||||
if [ -f "$ZEEKLOG" ]; then
|
||||
CURRENTTS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g')
|
||||
if [ -f "$LASTCAPTURELOSSLOG" ]; then
|
||||
LASTTS=$(cat $LASTCAPTURELOSSLOG)
|
||||
if [[ "$LASTTS" != "$CURRENTTS" ]]; then
|
||||
LOSS=$(tail -$WORKERS $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -v WORKERS=$WORKERS -F: '{LOSS += $2 / WORKERS} END { print LOSS}')
|
||||
echo "zeekcaptureloss loss=$LOSS"
|
||||
if [ -d "/host/nsm/zeek/spool/logger" ]; then
|
||||
WORKERS={{ salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) }}
|
||||
ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log
|
||||
elif [ -d "/host/nsm/zeek/spool/zeeksa" ]; then
|
||||
WORKERS=1
|
||||
ZEEKLOG=/host/nsm/zeek/spool/zeeksa/capture_loss.log
|
||||
else
|
||||
echo 'Zeek capture_loss.log not found' >/dev/stderr
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
echo "$CURRENTTS" > $LASTCAPTURELOSSLOG
|
||||
|
||||
LASTCAPTURELOSSLOG=/var/log/telegraf/lastcaptureloss.txt
|
||||
if [ -f "$ZEEKLOG" ]; then
|
||||
CURRENTTS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g')
|
||||
if [ -f "$LASTCAPTURELOSSLOG" ]; then
|
||||
LASTTS=$(cat $LASTCAPTURELOSSLOG)
|
||||
if [[ "$LASTTS" != "$CURRENTTS" ]]; then
|
||||
LOSS=$(tail -$WORKERS $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -v WORKERS=$WORKERS -F: '{LOSS += $2 / WORKERS} END { print LOSS}')
|
||||
echo "zeekcaptureloss loss=$LOSS"
|
||||
fi
|
||||
fi
|
||||
echo "$CURRENTTS" > $LASTCAPTURELOSSLOG
|
||||
fi
|
||||
else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -17,34 +17,32 @@
|
||||
|
||||
# This script returns the packets dropped by Zeek, but it isn't a percentage. $LOSS * 100 would be the percentage
|
||||
|
||||
APP=zeekloss
|
||||
lf=/tmp/$APP-pidLockFile
|
||||
# create empty lock file if none exists
|
||||
cat /dev/null >> $lf
|
||||
read lastPID < $lf
|
||||
# if lastPID is not null and a process with that pid exists , exit
|
||||
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
|
||||
echo $$ > $lf
|
||||
THEGREP=$(ps -ef | grep $0 | grep -v $$ | grep -v grep)
|
||||
|
||||
ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
|
||||
declare RESULT=($ZEEKLOG)
|
||||
CURRENTDROP=${RESULT[3]}
|
||||
# zeek likely not running if this is true
|
||||
if [[ $CURRENTDROP == "rcvd:" ]]; then
|
||||
CURRENTDROP=0
|
||||
PASTDROP=0
|
||||
DROPPED=0
|
||||
if [ ! "$THEGREP" ]; then
|
||||
|
||||
ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
|
||||
declare RESULT=($ZEEKLOG)
|
||||
CURRENTDROP=${RESULT[3]}
|
||||
# zeek likely not running if this is true
|
||||
if [[ $CURRENTDROP == "rcvd:" ]]; then
|
||||
CURRENTDROP=0
|
||||
PASTDROP=0
|
||||
DROPPED=0
|
||||
else
|
||||
PASTDROP=${RESULT[9]}
|
||||
DROPPED=$((CURRENTDROP - PASTDROP))
|
||||
fi
|
||||
if [[ "$DROPPED" -le 0 ]]; then
|
||||
LOSS=0
|
||||
echo "zeekdrop drop=0"
|
||||
else
|
||||
CURRENTPACKETS=${RESULT[5]}
|
||||
PASTPACKETS=${RESULT[11]}
|
||||
TOTAL=$((CURRENTPACKETS - PASTPACKETS))
|
||||
LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
|
||||
echo "zeekdrop drop=$LOSS"
|
||||
fi
|
||||
else
|
||||
PASTDROP=${RESULT[9]}
|
||||
DROPPED=$((CURRENTDROP - PASTDROP))
|
||||
fi
|
||||
if [[ "$DROPPED" -le 0 ]]; then
|
||||
LOSS=0
|
||||
echo "zeekdrop drop=0"
|
||||
else
|
||||
CURRENTPACKETS=${RESULT[5]}
|
||||
PASTPACKETS=${RESULT[11]}
|
||||
TOTAL=$((CURRENTPACKETS - PASTPACKETS))
|
||||
LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
|
||||
echo "zeekdrop drop=$LOSS"
|
||||
exit 0
|
||||
fi
|
||||
Reference in New Issue
Block a user