mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-11-09 22:20:00 +01:00
Josh Patterson
72f60fcaa9
so-telegraf mounted /var/run/docker.sock and joined the host docker group on every node type. The :ro flag blocks write() to the inode, not connect() plus HTTP over the socket, so any code execution inside the container could reach POST /containers/create with Privileged:true and become root on the host. No telegraf script used the socket; the only consumer was the native [[inputs.docker]] plugin, and group_add 920 existed solely to feed it. Container metrics now come from so-container-stats, a collector that runs on the host from cron and writes influx line protocol to a file telegraf already had mounted. This is the pattern so-status, so-raid-status and so-elasticagent-status already use, so the privileged docker access stays on the host side where root cron already ran it. The collector runs as somon, a service account in the docker group with no login shell and a locked password, rather than root. Docker group membership is still root-equivalent on the host, so this is defense in depth rather than a privilege boundary. The telegraf scripts were root:939 mode 770, letting socore rewrite them for code execution inside the container; they are now 750, which still allows the read and execute telegraf needs. The container also ran with no group, giving it gid 0, and now runs as 939:939. That alone would have broken lasthighstate.sh, which reached /opt/so/log/salt only via the root group and could not tell an unreadable file from a missing one, so it silently reported a 56 year highstate age. Only the lasthighstate file is bind mounted now, and the script tests readability instead of existence. Everything inputs.docker collected beyond the five fields the shipped dashboards query is available per stat under telegraf:container_stats, annotated for SOC so an operator can enable it without editing files. Defaults reproduce the previous output exactly. With every stat enabled the emitted field set matches what inputs.docker wrote, verified by running the plugin against the live socket and diffing: 53 fields, no type mismatches, no field present on one side only. Two deliberate differences: max_usage carries the real cgroup peak where the daemon reports 0 on cgroup v2, and host-network containers emit no docker_container_net row, matching inputs.docker. Docker label tags are not restored, since nothing queries them and they cost significant cardinality. so-status, the influxdb size cron, so-elasticagent-status, so-raid-status and so-common-status-check truncated their output in place while telegraf read it, so telegraf periodically saw an empty file and logged a parse error or emitted empty values. They now write aside and rename. Measured on a live manager, the old so-status cron left status.log empty for 215 of 10997 reads. Tested on a fresh install, a converted grid and a 3.0 upgrade.
387 lines
14 KiB
YAML
387 lines
14 KiB
YAML
telegraf:
|
|
enabled:
|
|
description: Enables the grid metrics collection process. WARNING - Security Onion grid health monitoring requires this process to remain enabled. Disabling it will cause unexpected and unsupported results.
|
|
forcedType: bool
|
|
advanced: True
|
|
helpLink: influxdb
|
|
output:
|
|
description: Selects the backend(s) Telegraf writes metrics to. INFLUXDB keeps the current behavior; POSTGRES writes to the grid's Postgres instance; BOTH dual-writes for migration validation. When set to BOTH, the grid screen's metrics are pulled from Postgres, and the InfluxDB tool link remains visible. When set to POSTGRES, the InfluxDB tool link is removed.
|
|
options:
|
|
- INFLUXDB
|
|
- POSTGRES
|
|
- BOTH
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
config:
|
|
interval:
|
|
description: Data collection interval.
|
|
global: True
|
|
helpLink: influxdb
|
|
metric_batch_size:
|
|
description: Data collection batch size.
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
metric_buffer_limit:
|
|
description: Data collection buffer size.
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
collection_jitter:
|
|
description: Jitter of the flush interval.
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
flush_interval:
|
|
description: Flush interval for all outputs.
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
flush_jitter:
|
|
description: Jitter the flush interval.
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
debug:
|
|
description: Run telegraf with debug log messages
|
|
forcedType: bool
|
|
advanced: True
|
|
helpLink: influxdb
|
|
quiet:
|
|
description: Run telegraf in quiet mode (error log messages only).
|
|
forcedType: bool
|
|
advanced: True
|
|
helpLink: influxdb
|
|
container_stats:
|
|
tags:
|
|
identity:
|
|
description: Adds the container_image, container_version, engine_host and server_version tags to every container measurement, as the retired inputs.docker plugin did. Increases series cardinality. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
engine:
|
|
n_containers:
|
|
description: Total number of containers known to the Docker engine, running or not. Part of the engine-level docker measurement. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_containers_running:
|
|
description: Number of containers currently running. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_containers_stopped:
|
|
description: Number of containers currently stopped. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_containers_paused:
|
|
description: Number of containers currently paused. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_images:
|
|
description: Number of container images held by the Docker engine. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_cpus:
|
|
description: Number of CPUs the Docker engine reports for this host. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_goroutines:
|
|
description: Number of goroutines inside the Docker daemon. Diagnostic detail for the daemon itself. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_used_file_descriptors:
|
|
description: Number of file descriptors held open by the Docker daemon. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
n_listener_events:
|
|
description: Number of event listeners subscribed to the Docker daemon. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
memory_total:
|
|
description: Total physical memory the Docker engine reports for this host, in bytes. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
cpu:
|
|
usage_percent:
|
|
description: Percentage of host CPU consumed by the container. Required by the Container CPU Usage chart on the Security Onion Performance dashboard.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
usage_total:
|
|
description: Cumulative CPU time consumed by the container, in nanoseconds. Read from the cgroup. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
usage_in_usermode:
|
|
description: Cumulative CPU time consumed in user mode, in nanoseconds. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
usage_in_kernelmode:
|
|
description: Cumulative CPU time consumed in kernel mode, in nanoseconds. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
usage_system:
|
|
description: Cumulative host-wide CPU time, in nanoseconds. Used as the denominator when calculating container CPU percentage. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
throttling_periods:
|
|
description: Number of CPU enforcement periods the container has seen. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
throttling_throttled_periods:
|
|
description: Number of periods in which the container was throttled against its CPU limit. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
throttling_throttled_time:
|
|
description: Total time the container spent throttled, in nanoseconds. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
container_id: &containerid
|
|
description: Full 64 character container ID, emitted as a field on this measurement. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
mem:
|
|
usage_percent:
|
|
description: Percentage of its memory limit the container is using. Required by the Container Memory Usage chart on the Security Onion Performance dashboard.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
usage:
|
|
description: Container memory usage in bytes, excluding reclaimable page cache. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
limit:
|
|
description: Memory limit for the container in bytes. Reports total host memory when the container is unlimited. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
max_usage:
|
|
description: Peak memory usage for the container in bytes, read from the cgroup peak counter. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
active_anon:
|
|
description: Anonymous memory on the active LRU list, in bytes. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
active_file:
|
|
description: Page cache on the active LRU list, in bytes. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
inactive_anon:
|
|
description: Anonymous memory on the inactive LRU list, in bytes. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
inactive_file:
|
|
description: Page cache on the inactive LRU list, in bytes. This is the reclaimable cache subtracted from usage. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
unevictable:
|
|
description: Memory that cannot be reclaimed, in bytes. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
pgfault:
|
|
description: Cumulative number of page faults taken by the container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
pgmajfault:
|
|
description: Cumulative number of major page faults, those requiring disk access. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
container_id: *containerid
|
|
net:
|
|
rx_bytes:
|
|
description: Bytes received by the container across all interfaces except loopback. Required by the Container Traffic - Inbound chart on the Security Onion Performance dashboard.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
rx_packets:
|
|
description: Packets received by the container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
rx_errors:
|
|
description: Receive errors counted on the container interfaces. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
rx_dropped:
|
|
description: Received packets dropped by the container interfaces. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
tx_bytes:
|
|
description: Bytes transmitted by the container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
tx_packets:
|
|
description: Packets transmitted by the container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
tx_errors:
|
|
description: Transmit errors counted on the container interfaces. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
tx_dropped:
|
|
description: Transmitted packets dropped by the container interfaces. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
container_id: *containerid
|
|
blkio:
|
|
io_service_bytes_recursive_read:
|
|
description: Cumulative bytes read from block devices by the container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
io_service_bytes_recursive_write:
|
|
description: Cumulative bytes written to block devices by the container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
container_id: *containerid
|
|
status:
|
|
uptime_ns:
|
|
description: How long the container has been running, in nanoseconds. Required by the Container Uptime chart on the Security Onion Performance dashboard.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
oomkilled:
|
|
description: Whether the container was killed by the kernel out-of-memory handler. Required by the Most Recent Container Events table on the Security Onion Performance dashboard.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
pid:
|
|
description: Host process ID of the container main process. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
exitcode:
|
|
description: Exit code of the container main process. Meaningful once the container has stopped. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
restart_count:
|
|
description: Number of times the Docker engine has restarted this container. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
started_at:
|
|
description: Time the container last started, as a Unix timestamp in nanoseconds. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
finished_at:
|
|
description: Time the container last exited, as a Unix timestamp in nanoseconds. Absent for a container that has never exited. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
container_id: *containerid
|
|
health:
|
|
health_status:
|
|
description: Result of the container healthcheck, such as healthy, unhealthy or starting. Only emitted for containers that define a healthcheck. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
failing_streak:
|
|
description: Number of consecutive failed healthchecks. Only emitted for containers that define a healthcheck. Defaults to off.
|
|
forcedType: bool
|
|
global: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
scripts:
|
|
eval: &telegrafscripts
|
|
description: List of input.exec scripts to run for this node type. The script must be present in salt/telegraf/scripts.
|
|
forcedType: "[]string"
|
|
multiline: True
|
|
advanced: True
|
|
helpLink: influxdb
|
|
standalone: *telegrafscripts
|
|
manager: *telegrafscripts
|
|
managersearch: *telegrafscripts
|
|
import: *telegrafscripts
|
|
sensor: *telegrafscripts
|
|
heavynode: *telegrafscripts
|
|
idh: *telegrafscripts
|
|
searchnode: *telegrafscripts
|
|
receiver: *telegrafscripts
|
|
fleet: *telegrafscripts
|
|
desktop: *telegrafscripts
|