mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-20 22:54:26 +02:00
Josh Patterson
9652a2053b
zeekctl's post-terminate archives the final logs in the background and returns immediately unless StopWait is set, so the container exits and takes the archiving with it, stranding unarchived logs in /nsm/zeek/spool/tmp on every restart. Docker's default 10s grace is also too tight for the entrypoint's SIGTERM trap; overrunning it means SIGKILL and crash directories on the next start. Both are needed. StopWait alone gives the stop more work to do inside the same 10s window, which was measured ending in SIGKILL with logs stranded in the spool. disabled.sls used docker rm -f, which never delivers SIGTERM, so stop the container before removing it. Reported in discussion #16174.
116 lines
4.2 KiB
YAML+Jinja
116 lines
4.2 KiB
YAML+Jinja
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
{% from 'allowed_states.map.jinja' import allowed_states %}
|
|
{% if sls.split('.')[0] in allowed_states %}
|
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
|
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
|
|
|
|
|
include:
|
|
- zeek.config
|
|
- zeek.sostatus
|
|
|
|
so-zeek:
|
|
docker_container.running:
|
|
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-zeek:{{ GLOBALS.so_version }}
|
|
- restart_policy: unless-stopped
|
|
- start: True
|
|
- privileged: True
|
|
# Docker's default 10s grace is not enough for the entrypoint's SIGTERM trap to run
|
|
# 'zeekctl stop' and let StopWait archive the final logs. Overrunning it means SIGKILL,
|
|
# which strands those logs in spool/tmp and marks every node crashed on the next start.
|
|
- stop_timeout: 180
|
|
{% if DOCKERMERGED.containers['so-zeek'].ulimits %}
|
|
- ulimits:
|
|
{% for ULIMIT in DOCKERMERGED.containers['so-zeek'].ulimits %}
|
|
- {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
- binds:
|
|
- /nsm/zeek/logs:/nsm/zeek/logs:rw
|
|
- /nsm/zeek/spool:/nsm/zeek/spool:rw
|
|
- /nsm/zeek/extracted:/nsm/zeek/extracted:rw
|
|
- /opt/so/conf/zeek/local.zeek:/opt/zeek/share/zeek/site/local.zeek:ro
|
|
- /opt/so/conf/zeek/node.cfg:/opt/zeek/etc/node.cfg:ro
|
|
- /opt/so/conf/zeek/networks.cfg:/opt/zeek/etc/networks.cfg:ro
|
|
- /opt/so/conf/zeek/zeekctl.cfg:/opt/zeek/etc/zeekctl.cfg:ro
|
|
- /opt/so/conf/zeek/policy/securityonion:/opt/zeek/share/zeek/policy/securityonion:ro
|
|
- /opt/so/conf/zeek/policy/custom:/opt/zeek/share/zeek/policy/custom:ro
|
|
- /opt/so/conf/zeek/policy/cve-2020-0601:/opt/zeek/share/zeek/policy/cve-2020-0601:ro
|
|
- /opt/so/conf/zeek/policy/intel:/opt/zeek/share/zeek/policy/intel:rw
|
|
- /opt/so/conf/zeek/bpf:/opt/zeek/etc/bpf:ro
|
|
- /opt/so/conf/zeek/config.zeek:/opt/zeek/share/zeek/site/packages/ja4/config.zeek:ro
|
|
- /opt/so/conf/zeek/zkg:/opt/so/conf/zeek/zkg:ro
|
|
{% if DOCKERMERGED.containers['so-zeek'].custom_bind_mounts %}
|
|
{% for BIND in DOCKERMERGED.containers['so-zeek'].custom_bind_mounts %}
|
|
- {{ BIND }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
- network_mode: host
|
|
{% if DOCKERMERGED.containers['so-zeek'].extra_hosts %}
|
|
- extra_hosts:
|
|
{% for XTRAHOST in DOCKERMERGED.containers['so-zeek'].extra_hosts %}
|
|
- {{ XTRAHOST }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% if DOCKERMERGED.containers['so-zeek'].extra_env %}
|
|
- environment:
|
|
{% for XTRAENV in DOCKERMERGED.containers['so-zeek'].extra_env %}
|
|
- {{ XTRAENV }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
- watch:
|
|
- file: /opt/so/conf/zeek/local.zeek
|
|
- file: /opt/so/conf/zeek/node.cfg
|
|
- file: /opt/so/conf/zeek/networks.cfg
|
|
- file: /opt/so/conf/zeek/zeekctl.cfg
|
|
- file: /opt/so/conf/zeek/policy
|
|
- file: /opt/so/conf/zeek/bpf
|
|
- require:
|
|
- file: localzeek
|
|
- file: nodecfg
|
|
- file: zeekctlcfg
|
|
- file: zeekbpf
|
|
|
|
delete_so-zeek_so-status.disabled:
|
|
file.uncomment:
|
|
- name: /opt/so/conf/so-status/so-status.conf
|
|
- regex: ^so-zeek$
|
|
|
|
zeekpacketlosscron:
|
|
cron.present:
|
|
- name: /usr/local/bin/packetloss.sh
|
|
- identifier: zeekpacketlosscron
|
|
- user: root
|
|
- minute: '*/10'
|
|
- hour: '*'
|
|
- daymonth: '*'
|
|
- month: '*'
|
|
- dayweek: '*'
|
|
|
|
# LogExpireInterval, StatsLogExpireInterval and CrashExpireInterval are only acted on by
|
|
# 'zeekctl cron', so run it on the interval upstream recommends. This also restarts any
|
|
# node that died unexpectedly. Runs as root because the script needs the docker socket;
|
|
# it drops to the zeek user inside the container.
|
|
zeekctlcron:
|
|
cron.present:
|
|
- name: /usr/sbin/so-zeek-cron > /dev/null 2>&1
|
|
- identifier: zeekctlcron
|
|
- user: root
|
|
- minute: '*/5'
|
|
- hour: '*'
|
|
- daymonth: '*'
|
|
- month: '*'
|
|
- dayweek: '*'
|
|
|
|
{% else %}
|
|
|
|
{{sls}}_state_not_allowed:
|
|
test.fail_without_changes:
|
|
- name: {{sls}}_state_not_allowed
|
|
|
|
{% endif %}
|