event-handler: T3083: Add simple event-handler

[sever-sever]

Change Summary

Event-handler allows executing a custom script when in logs it
detects configured "pattern"
A simple implementation

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://phabricator.vyos.net/T3083

Component(s) name

Proposed changes

How to test

set service event-handler event first filter pattern '.*ssh2.*'
set service event-handler event first script arguments '192.0.2.5'
set service event-handler event first script environment interface value 'eth0'
set service event-handler event first script path '/config/scripts/hello.sh'

cat hello.sh:

vyos@r14:~$ cat /config/scripts/hello.sh 
#!/usr/bin/env bash

echo "$(date) Hello world! From script, first arg ${1}" >> /tmp/hello.txt

Expect vyos-event-handle.service

vyos@r14:~$ sudo systemctl status vyos-event-handler.service
● vyos-event-handler.service - VyOS event handler
     Loaded: loaded (/lib/systemd/system/vyos-event-handler.service; disabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-06-07 15:23:03 EEST; 1min 39s ago
   Main PID: 17489 (python3)
      Tasks: 1 (limit: 4695)
     Memory: 7.8M
        CPU: 48ms
     CGroup: /system.slice/vyos-event-handler.service
             └─17489 /usr/bin/python3 /usr/libexec/vyos/system/vyos-event-handler.py --config /run/vyos-event-handler.conf

Jun 07 15:23:03 r14 systemd[1]: Started VyOS event handler.
Jun 07 15:23:03 r14 vyos-event-handler[17489]: Started with configuration: {'first': {'filter': {'pattern': '.*ssh2.*'}, 'script': {'arguments': '192.0.2.5', 'environment': {'interface': {'value': 'eth0'}}, 'path': '/config/scripts/hello.sh'}}}
Jun 07 15:23:13 r14 vyos-event-handler[17489]: Pattern found: ".*ssh2.*", script executed: "/config/scripts/hello.sh 192.0.2.5"

Connect via ssh and check journalctl

...
Jun 07 15:23:13 r14 vyos-event-handler[17489]: Pattern found: ".*ssh2.*", script executed: "/config/scripts/hello.sh 192.0.2.5"
...

check cat /tmp/hello.txt

Tue 07 Jun 2022 03:23:13 PM EEST Hello world! From script, first arg 192.0.2.5

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[zdc]

Can it be extended by adding logging of received messages and running scripts? Most likely you need to exclude logs produced by the program itself to avoid endless loops.

Maybe you want to use required instead if len(argv)?

Also, you should switch to compiled regular expression objects. This reduces CPU usage a lot in systems with intensive logs.

[dmbaturin]

I think the idea is sensible: reading the system log from journald is the only thing that doesn't open a huge can of worms with dying processes, disappearing log files and other unfortunate situations.

However, I think we should make it possible to watch for multiple patterns. I also left a few more ideas and suggestions there in the review.

[c-po]

Lets merge it, play it, and improve it :)