mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-16 09:42:11 +02:00
cefbe01333
Introduces global.telegraf_output (INFLUXDB|POSTGRES|BOTH, default BOTH) so Telegraf can write metrics to Postgres alongside or instead of InfluxDB. Each minion authenticates with its own so_telegraf_<minion> role and writes to a matching schema inside a shared so_telegraf database, keeping blast radius per-credential to that minion's data. - Per-minion credentials auto-generated and persisted in postgres/auth.sls - postgres/telegraf_users.sls reconciles roles/schemas on every apply - Firewall opens 5432 only to minion hostgroups when Postgres output is active - Reactor on salt/auth + orch/telegraf_postgres_sync.sls provision new minions automatically on key accept - soup post_to_3.1.0 backfills users for existing minions on upgrade - so-show-stats prints latest CPU/mem/disk/load per minion for sanity checks - so-telegraf-trim + nightly cron prune rows older than postgres.telegraf.retention_days (default 14)
27 lines
827 B
Plaintext
27 lines
827 B
Plaintext
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
{% set MINION = salt['pillar.get']('minion_id') %}
|
|
{% set MANAGER = salt['pillar.get']('setup:manager') or salt['grains.get']('master') %}
|
|
|
|
manager_sync_telegraf_pg_users:
|
|
salt.state:
|
|
- tgt: {{ MANAGER }}
|
|
- sls:
|
|
- postgres.auth
|
|
- postgres.telegraf_users
|
|
- queue: True
|
|
|
|
{% if MINION and MINION != MANAGER %}
|
|
{{ MINION }}_apply_telegraf:
|
|
salt.state:
|
|
- tgt: {{ MINION }}
|
|
- sls:
|
|
- telegraf
|
|
- queue: True
|
|
- require:
|
|
- salt: manager_sync_telegraf_pg_users
|
|
{% endif %}
|