CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

only send loss if timestamp on data has changed

Browse Source
This commit is contained in:
m0duspwnens
2020-10-07 11:06:54 -04:00
parent 5e534571ff
commit f96d6ae4f4
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/telegraf/scripts/zeekcaptureloss.sh
View File

@@ -2,9 +2,15 @@
# This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp # This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp
{%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %} {%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %}
ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log
LASTCAPTURELOSSLOG=/script/lastcaptureloss.txt
if [ -f "$ZEEKLOG" ]; then if [ -f "$ZEEKLOG" ]; then
LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print LOSS}') CURRENTTS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g')
TS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g') if [ -f "$LASTCAPTURELOSSLOG" ]; then
TSNANO=$(echo "$(date -d "$TS" +"%s.%N") 1000000000 * p" | dc | awk -F. {'print $1'}) LASTTS=$(cat /script/lastcaptureloss.txt)
echo "zeekcaptureloss loss=$LOSS $TSNANO" if [[ "$LASTTS" != "$CURRENTTS" ]]; then
LOSS=$(tail -{{WORKERS}} $ZEEKLOG | awk -F, '{print $NF}' | sed 's/}//' | awk -F: '{LOSS += $2 / {{WORKERS}}} END { print LOSS}')
echo "zeekcaptureloss loss=$LOSS"
fi
fi
echo "$CURRENTS" > "$LASTCAPTURELOSSLOG"
fi fi