securityonion/salt/postgres/soc_postgres.yaml at 6f9da893acf706f548f3e91b88a5d5a4c473a647 - securityonion - CSEC Git

CSEC_PUBLIC/securityonion

mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-16 01:32:07 +02:00

Files

Mike Reeves cefbe01333 Add telegraf_output selector for InfluxDB/Postgres dual-write

Introduces global.telegraf_output (INFLUXDB|POSTGRES|BOTH, default BOTH)
so Telegraf can write metrics to Postgres alongside or instead of
InfluxDB. Each minion authenticates with its own so_telegraf_<minion>
role and writes to a matching schema inside a shared so_telegraf
database, keeping blast radius per-credential to that minion's data.

- Per-minion credentials auto-generated and persisted in postgres/auth.sls
- postgres/telegraf_users.sls reconciles roles/schemas on every apply
- Firewall opens 5432 only to minion hostgroups when Postgres output is active
- Reactor on salt/auth + orch/telegraf_postgres_sync.sls provision new
  minions automatically on key accept
- soup post_to_3.1.0 backfills users for existing minions on upgrade
- so-show-stats prints latest CPU/mem/disk/load per minion for sanity checks
- so-telegraf-trim + nightly cron prune rows older than
  postgres.telegraf.retention_days (default 14)

2026-04-15 14:32:10 -04:00

8 lines

253 B

YAML

Raw Blame History

 postgres:
   telegraf:
     retention_days:
       description: Number of days of Telegraf metrics to keep in the so_telegraf database. Older rows are deleted nightly by so-telegraf-trim.
       forcedType: int
       advanced: True
       helpLink: influxdb