program_output does not work for any command other than "mail"

[mirislam]

So here is an odd problem. Looks like the program_output does not work for any binary other than mail. I am suspecting that there is a whitelist of binary which can be used in program_output but not documented. To validate that theory, I replaced my "mail" binary and put a shell script called "mail" which calls the binary I want (in this case curl to post to elasticsearch). Sure enough that worked.

Is this a bug or a feature? If it is a feature where is the documentation for the allowed programs?

# Possible additional things you might want to do with program output:
#   - send to a slack webhook:
#         program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
#   - logging (alternate method than syslog):
#         program: logger -t falco-test
#   - send over a network connection:
#         program: nc host.example.com 80

# If keep_alive is set to true, the program will be started once and
# continuously written to, with each output message on its own
# line. If keep_alive is set to false, the program will be re-spawned
# for each output message.
#
# Also, the program will be closed and reopened if falco is signaled with
# SIGUSR1.
program_output:
  enabled: false
  keep_alive: false
  program: mail -s "Falco Notification" root

program_output:
  enabled: true
  keep_alive: true
  program: mail "Nothing here"

# sent to elasticsearch
program_output:
  enabled: true
  keep_alive: false
  program: "jq '{text: .output}' | curl -d @- -X POST http://localhost:9200/falco"

program_output:
  enabled: true
  keep_alive: true
  program: "curl  -H 'Content-Type: application/json' -d @- -X POST http://localhost:9200/falco"

[mirislam]

BTW forgot to mention this is similar to issue #127

[mfdii]

The problem is that you currently can only have one of each output type (program, file, etc). I’ll put this on our roadmap of things to look at fixing, and we should update documentation as well.

…

On Sep 22, 2018, at 2:57 PM, Mir Islam ***@***.***> wrote: BTW forgot to mention this is similar to issue #127 — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[mirislam]

Thanks. I tried and when there is only one program_output, it worked. Having multiple program_output will be a very useful feature. I guess I can always wrap multiple commands in a bash script

[mstemm]

The docs have been updated. I filed a new issue #458 to track the feature request. Closing this issue.