mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-07-18 14:53:40 +02:00
Josh Patterson
9e7e6edae0
Add 100%-coverage unit tests for the three custom salt beacons (postgres_pillar_beacon, rules_beacon, zeek) and add salt/_beacons to the python-test workflow's paths trigger and matrix. To pass the workflow's flake8 lint over the whole directory: - zeek.py: reindent to 4 spaces, drop trailing blank line, noqa the Salt-injected __salt__ references (F821); no logic change. - postgres_pillar_beacon.py: noqa C901 on beacon() (complexity 13 > 12).
33 lines
1002 B
Python
33 lines
1002 B
Python
import logging
|
|
|
|
|
|
def status():
|
|
|
|
cmd = "runuser -l zeek -c '/opt/zeek/bin/zeekctl status'"
|
|
retval = __salt__['docker.run']('so-zeek', cmd) # noqa: F821
|
|
logging.info('zeekctl_module: zeekctl.status retval: %s' % retval)
|
|
|
|
return retval
|
|
|
|
|
|
def beacon(config):
|
|
|
|
retval = []
|
|
|
|
is_enabled = __salt__['healthcheck.is_enabled']() # noqa: F821
|
|
logging.info('zeek_beacon: healthcheck_is_enabled: %s' % is_enabled)
|
|
|
|
if is_enabled:
|
|
zeekstatus = status().lower().split(' ')
|
|
logging.info('zeek_beacon: zeekctl.status: %s' % str(zeekstatus))
|
|
if 'stopped' in zeekstatus or 'crashed' in zeekstatus or 'error' in zeekstatus or 'error:' in zeekstatus:
|
|
zeek_restart = True
|
|
else:
|
|
zeek_restart = False
|
|
|
|
__salt__['telegraf.send']('healthcheck zeek_restart=%s' % str(zeek_restart)) # noqa: F821
|
|
retval.append({'zeek_restart': zeek_restart})
|
|
logging.info('zeek_beacon: retval: %s' % str(retval))
|
|
|
|
return retval
|