securityonion/salt/global/defaults.yaml at cefbe01333ee9a1894aa623fdc7b5aa928b507ef - securityonion - CSEC Git

CSEC_PUBLIC/securityonion

mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-16 17:52:50 +02:00

Files

Mike Reeves cefbe01333 Add telegraf_output selector for InfluxDB/Postgres dual-write

Introduces global.telegraf_output (INFLUXDB|POSTGRES|BOTH, default BOTH)
so Telegraf can write metrics to Postgres alongside or instead of
InfluxDB. Each minion authenticates with its own so_telegraf_<minion>
role and writes to a matching schema inside a shared so_telegraf
database, keeping blast radius per-credential to that minion's data.

- Per-minion credentials auto-generated and persisted in postgres/auth.sls
- postgres/telegraf_users.sls reconciles roles/schemas on every apply
- Firewall opens 5432 only to minion hostgroups when Postgres output is active
- Reactor on salt/auth + orch/telegraf_postgres_sync.sls provision new
  minions automatically on key accept
- soup post_to_3.1.0 backfills users for existing minions on upgrade
- so-show-stats prints latest CPU/mem/disk/load per minion for sanity checks
- so-telegraf-trim + nightly cron prune rows older than
  postgres.telegraf.retention_days (default 14)

2026-04-15 14:32:10 -04:00

4 lines

72 B

YAML

Raw Blame History

 global:
   pcapengine: SURICATA
   pipeline: REDIS
   telegraf_output: BOTH