No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
bin first commit Nov 3, 2018
gemfiles
lib
spec
.gitignore
.rspec
.travis.yml
Appraisals
Gemfile
LICENSE.txt
README.md
Rakefile Fix .travis.yml Nov 4, 2018
fluent-plugin-filter-parse-audit-log.gemspec

README.md

fluent-plugin-filter-parse-audit-log

Fluentd Filter Plugin to parse linux's audit log.

Gem Version Build Status

Installation

Add this line to your application's Gemfile:

gem 'fluent-plugin-filter-audit-log'

And then execute:

$ bundle

Or install it yourself as:

$ gem install fluent-plugin-filter-audit-log

Configuration

@type parse_audit_log
#key message
#flatten false

Output

<source>
  @type forward
</source>

<filter audit.log>
  @type parse_audit_log
</filter>

<match audit.log>
  @type stdout
</match>
echo '{"message":"type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm=\"cat\" exe=\"/bin/cat\" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=\"sshd_config\""}' \
| fluent-cat -t audit.log
{
  "header": {
    "type": "SYSCALL",
    "msg": "audit(1364481363.243:24287)"
  },
  "body": {
    "arch": "c000003e",
    "syscall": "2",
    "success": "no",
    "exit": "-13",
    "a0": "7fffd19c5592",
    "a1": "0",
    "a2": "7fffd19c4b50",
    "a3": "a",
    "items": "1",
    "ppid": "2686",
    "pid": "3538",
    "auid": "500",
    "uid": "500",
    "gid": "500",
    "euid": "500",
    "suid": "500",
    "fsuid": "500",
    "egid": "500",
    "sgid": "500",
    "fsgid": "500",
    "tty": "pts0",
    "ses": "1",
    "comm": "\"cat\"",
    "exe": "\"/bin/cat\"",
    "subj": "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023",
    "key": "\"sshd_config\""
  }
}

Related Links