mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-08 18:22:47 +01:00
changing back from beacon to scheduled jobs for healthcheck
This commit is contained in:
@@ -61,5 +61,3 @@ peer:
|
|||||||
reactor:
|
reactor:
|
||||||
- 'so/fleet':
|
- 'so/fleet':
|
||||||
- salt://reactor/fleet.sls
|
- salt://reactor/fleet.sls
|
||||||
- 'salt/beacon/*/zeek/':
|
|
||||||
- salt://reactor/zeek.sls
|
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
healthcheck:
|
healthcheck:
|
||||||
enabled: False
|
enabled: False
|
||||||
schedule: 60
|
schedule: 10
|
||||||
checks:
|
checks:
|
||||||
- zeek
|
- zeek
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
healthcheck:
|
healthcheck:
|
||||||
enabled: False
|
enabled: False
|
||||||
schedule: 60
|
schedule: 10
|
||||||
checks:
|
checks:
|
||||||
- zeek
|
- zeek
|
||||||
|
|||||||
@@ -3,7 +3,7 @@
|
|||||||
import logging
|
import logging
|
||||||
import sys
|
import sys
|
||||||
|
|
||||||
allowed_functions = ['is_enabled,zeek']
|
allowed_functions = ['is_enabled', 'zeek']
|
||||||
states_to_apply = []
|
states_to_apply = []
|
||||||
|
|
||||||
|
|
||||||
@@ -42,14 +42,14 @@ def run(checks=''):
|
|||||||
|
|
||||||
retval = []
|
retval = []
|
||||||
calling_func = sys._getframe().f_back.f_code.co_name
|
calling_func = sys._getframe().f_back.f_code.co_name
|
||||||
logging.debug('healthcheck_module: run function caller: %s' % calling_func)
|
logging.info('healthcheck_module: run function caller: %s' % calling_func)
|
||||||
|
|
||||||
if checks:
|
if checks:
|
||||||
checks = checks.split(',')
|
checks = checks.split(',')
|
||||||
else:
|
else:
|
||||||
checks = __salt__['pillar.get']('healthcheck:checks', {})
|
checks = __salt__['pillar.get']('healthcheck:checks', {})
|
||||||
|
|
||||||
logging.debug('healthcheck_module: run checks to be run: %s' % str(checks))
|
logging.info('healthcheck_module: run checks to be run: %s' % str(checks))
|
||||||
for check in checks:
|
for check in checks:
|
||||||
if check in allowed_functions:
|
if check in allowed_functions:
|
||||||
retval.append(check)
|
retval.append(check)
|
||||||
@@ -65,6 +65,11 @@ def run(checks=''):
|
|||||||
return retval
|
return retval
|
||||||
|
|
||||||
|
|
||||||
|
def send_event(tag, eventdata):
|
||||||
|
#__salt__['event.send'](tag, data={'stuff': 'things'})
|
||||||
|
__salt__['event.send'](tag, eventdata[0])
|
||||||
|
|
||||||
|
|
||||||
def zeek():
|
def zeek():
|
||||||
|
|
||||||
calling_func = sys._getframe().f_back.f_code.co_name
|
calling_func = sys._getframe().f_back.f_code.co_name
|
||||||
@@ -86,5 +91,6 @@ def zeek():
|
|||||||
|
|
||||||
retval.append({'zeek_restart': zeek_restart})
|
retval.append({'zeek_restart': zeek_restart})
|
||||||
|
|
||||||
|
send_event('so/healthcheck/zeek', retval)
|
||||||
__salt__['telegraf.send']('healthcheck zeek_restart=%s' % str(zeek_restart))
|
__salt__['telegraf.send']('healthcheck zeek_restart=%s' % str(zeek_restart))
|
||||||
return retval
|
return retval
|
||||||
|
|||||||
@@ -1,9 +1,6 @@
|
|||||||
### This state isn't used for anything. It was written to handle healthcheck scheduling,
|
|
||||||
### but we handle that with beacons now.
|
|
||||||
|
|
||||||
{% set CHECKS = salt['pillar.get']('healthcheck:checks', {}) %}
|
{% set CHECKS = salt['pillar.get']('healthcheck:checks', {}) %}
|
||||||
{% set ENABLED = salt['pillar.get']('healthcheck:enabled', False) %}
|
{% set ENABLED = salt['pillar.get']('healthcheck:enabled', False) %}
|
||||||
{% set SCHEDULE = salt['pillar.get']('healthcheck:schedule', 30) %}
|
{% set SCHEDULE = salt['pillar.get']('healthcheck:schedule', 10) %}
|
||||||
|
|
||||||
{% if CHECKS and ENABLED %}
|
{% if CHECKS and ENABLED %}
|
||||||
{% set STATUS = ['present','enabled'] %}
|
{% set STATUS = ['present','enabled'] %}
|
||||||
@@ -21,7 +18,7 @@ healthcheck_schedule_{{ STATUS[0] }}:
|
|||||||
schedule.{{ STATUS[0] }}:
|
schedule.{{ STATUS[0] }}:
|
||||||
- name: healthcheck
|
- name: healthcheck
|
||||||
- function: healthcheck.run
|
- function: healthcheck.run
|
||||||
- minutes: {{ SCHEDULE }}
|
- seconds: {{ SCHEDULE }}
|
||||||
|
|
||||||
healthcheck_schedule_{{ STATUS[1] }}:
|
healthcheck_schedule_{{ STATUS[1] }}:
|
||||||
schedule.{{ STATUS[1] }}:
|
schedule.{{ STATUS[1] }}:
|
||||||
|
|||||||
@@ -6,7 +6,7 @@ local = salt.client.LocalClient()
|
|||||||
|
|
||||||
def run():
|
def run():
|
||||||
minionid = data['id']
|
minionid = data['id']
|
||||||
zeek_restart = data['zeek_restart']
|
zeek_restart = data['data']['zeek_restart']
|
||||||
|
|
||||||
logging.info('zeek_reactor: zeek_need_restarted:%s on:%s' % (zeek_restart, minionid))
|
logging.info('zeek_reactor: zeek_need_restarted:%s on:%s' % (zeek_restart, minionid))
|
||||||
if zeek_restart:
|
if zeek_restart:
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ base:
|
|||||||
- firewall
|
- firewall
|
||||||
- pcap
|
- pcap
|
||||||
- suricata
|
- suricata
|
||||||
- salt.beacons
|
- healthcheck
|
||||||
{%- if BROVER != 'SURICATA' %}
|
{%- if BROVER != 'SURICATA' %}
|
||||||
- zeek
|
- zeek
|
||||||
{%- endif %}
|
{%- endif %}
|
||||||
@@ -58,7 +58,7 @@ base:
|
|||||||
- firewall
|
- firewall
|
||||||
- idstools
|
- idstools
|
||||||
- auth #Shared secrets
|
- auth #Shared secrets
|
||||||
- salt.beacons
|
- healthcheck
|
||||||
{%- if FLEETMASTER or FLEETNODE %}
|
{%- if FLEETMASTER or FLEETNODE %}
|
||||||
- mysql
|
- mysql
|
||||||
{%- endif %}
|
{%- endif %}
|
||||||
|
|||||||
Reference in New Issue
Block a user