Add script for docker events/metrics and support running TA outside of Splunk
* Add docker.sh and docker_metric.sh for collecting docker events/metrics * Add helper script to extra/ to run the TA commands on systems without a Splunk forwarder. The commands can be sent to a syslog server. This script is useful for systems with small or read-only filesystems that cannot support a Universal Forwarder. * Add syslog_inputs_nix_ta app to extra/ for ingesting the data from syslog
This commit is contained in:
parent
5e766d84d5
commit
5551b8973d
SSH key fingerprint:
SHA256:ukbnfrRMaRYlBZXENtBTyO2jLnql5AA5m+SzZCfYQe0
13 changed files with 322 additions and 13 deletions
159
extra/run_nix_ta_commands
Executable file
159
extra/run_nix_ta_commands
Executable file
|
|
@ -0,0 +1,159 @@
|
|||
#!/bin/bash
|
||||
|
||||
# This script allows getting the Techical Add-on for Unix and Linux data into
|
||||
# Splunk from systems that are not running a Splunk Universal Forwarder.
|
||||
# This is useful for systems with small or read-only file-systems.
|
||||
#
|
||||
# ## Sample rsyslog.conf
|
||||
# # Config for handling remote logs
|
||||
# template(name="RemoteLogs" type="string" string="/share/syslog/%FROMHOST%/%$.myprogramname%/%$.myprogramname%-%$YEAR%-%$MONTH%-%$DAY%.log")
|
||||
# # Write raw messages for splunk logs
|
||||
# template(name="RawMessageOnly" type="string" string="%$.mymsg%\n")
|
||||
# # Look for logs with nix_ta to apply RawMessagesOnly and send to RemoteLogs
|
||||
# if ($syslogtag startswith 'nix_ta_') then {
|
||||
# set $.mymsg = replace($msg, "#011", " ");
|
||||
# action(type="omfile" dynaFile="RemoteLogs" template="RawMessageOnly"
|
||||
# fileCreateMode="0644" dirCreateMode="0755"
|
||||
# fileOwner="root" fileGroup="splunk"
|
||||
# dirOwner="root" dirGroup="splunk")
|
||||
# stop
|
||||
# }
|
||||
# # End of sample rsyslog.conf
|
||||
#
|
||||
# To use:
|
||||
# * Modify the variables below to fit your environment
|
||||
# * ta_home: The directory you copied the Technical Add-on for Unix and Linux files
|
||||
# * tag_prefix: The events will be sent to syslog with ${tag_prefix}SCRIPTNAME as a tag
|
||||
# * syslog_server: The UDP syslog server to send events to
|
||||
# * run_minute: For scripts that have intervals over an hour, which minute to run them
|
||||
# * run_hour: For scripts that run once a day, which hour to run them
|
||||
# * Create a cron job: * * * * * /path/to/script/run_nix_ta_commands
|
||||
|
||||
# Ensure the logger command is available
|
||||
which logger > /dev/null 2>&1 || { echo "Error: The logger command is required for this script"; exit; }
|
||||
|
||||
ta_home=/srv/TA-unix
|
||||
tag_prefix=nix_ta_
|
||||
syslog_server=192.168.1.1
|
||||
run_minute=2
|
||||
run_hour=6
|
||||
|
||||
# Get the current minute now to be consistent through the script run
|
||||
minute=$(date +%_M | tr -d ' ')
|
||||
# Get the current hour now to be consistent through the script run
|
||||
hour=$(date +%_H | tr -d ' ')
|
||||
# Set defaults disabling force-mode and list-mode
|
||||
force=0
|
||||
list=0
|
||||
|
||||
usage() {
|
||||
echo "usage: $(basename $0) [-h] [-f] [-l] [script]"
|
||||
echo " -h: print this help text"
|
||||
echo " -f: run all enabled scripts regardless of interval"
|
||||
echo " -l: list scripts, enabled status, and interval (if enabled)"
|
||||
exit
|
||||
}
|
||||
|
||||
# Get the command line options
|
||||
while getopts ":hlf" opt; do
|
||||
case $opt in
|
||||
f) force=1 ;;
|
||||
l) list=1 ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
done
|
||||
shift $((OPTIND -1))
|
||||
|
||||
# Function to actually run the script and pipe it to logger
|
||||
runit() {
|
||||
[ -z "$1" ] && return 1
|
||||
if [ -x $ta_home/bin/$1.sh ]; then
|
||||
{ $ta_home/bin/$1.sh 2> /dev/null; echo; } | logger -n $syslog_server -t ${tag_prefix}$(echo $1|tr '[A-Z]' '[a-z]')
|
||||
else
|
||||
echo Could not find $1 in $ta_home/bin
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Check the inputs.conf to see if any of the checks are disabled
|
||||
declare -A scripts
|
||||
declare -A intervals
|
||||
# Load defaults first
|
||||
if [ -r $ta_home/default/inputs.conf ]; then
|
||||
eval $(awk -F '[=#]' '
|
||||
/^\[/{name=""}
|
||||
/^\[script:\/\//{n=split($1,a,"/");name=gensub(/\.[a-z]+\]/,"",1,a[n]);printf "scripts[%s]=1\nintervals[%s]=60\n",name,name}
|
||||
name!="" && $1~/(^|\s*)disabled(\s*|$)/ {disabled=gensub(/(^ | $)/,"","g",gensub(/true/,"1",1,gensub(/false/,"0",1,$2)));printf "scripts[%s]=%s\n",name,disabled}
|
||||
name!="" && $1~/(^|\s*)interval(\s*|$)/ {interval=gensub(/(^ | $)/,"","g",$2);printf "intervals[%s]=%s\n",name,interval}
|
||||
' $ta_home/default/inputs.conf)
|
||||
fi
|
||||
# See if any defaults are overridden in the local directory
|
||||
if [ -r $ta_home/local/inputs.conf ]; then
|
||||
eval $(awk -F '[=#]' '
|
||||
/^\[/{name="";disabled=1;interval=60}
|
||||
/^\[script:\/\//{n=split($1,a,"/");name=gensub(/\.[a-z]+\]/,"",1,a[n])}
|
||||
name!="" && $1~/(^|\s*)disabled(\s*|$)/ {disabled=gensub(/(^ | $)/,"","g",gensub(/true/,"1",1,gensub(/false/,"0",1,$2)));printf "scripts[%s]=%s\n",name,disabled}
|
||||
name!="" && $1~/(^|\s*)interval(\s*|$)/ {interval=gensub(/(^ | $)/,"","g",$2);printf "intervals[%s]=%s\n",name,interval}
|
||||
' $ta_home/local/inputs.conf)
|
||||
fi
|
||||
|
||||
# If -l, just print the scripts
|
||||
if [ $list = 1 ]; then
|
||||
for script in "${!scripts[@]}"; do
|
||||
if [ "${scripts[$script]}" = "0" ]; then
|
||||
echo "$script is enabled (${intervals[$script]} seconds)"
|
||||
else
|
||||
echo "$script is disabled"
|
||||
fi
|
||||
done
|
||||
exit
|
||||
fi
|
||||
|
||||
# If a script is specified on the command line, run it (even if disabled)
|
||||
if [ "$1" ]; then
|
||||
runit $1
|
||||
exit
|
||||
fi
|
||||
|
||||
# Without -l or -f, loop through the enabled scripts and run them at their interval
|
||||
for script in "${!scripts[@]}"; do
|
||||
# Only run enabled scripts
|
||||
if [ "${scripts[$script]}" = "0" ]; then
|
||||
i=${intervals[$script]}
|
||||
[ $i -lt 60 ] && i=60
|
||||
min=$((i/60))
|
||||
|
||||
# If -f, always run each script
|
||||
if [ $force = 1 ]; then
|
||||
runit $script
|
||||
|
||||
# If interval is 60 seconds or less, run every minute
|
||||
elif [ $min -le 1 ]; then
|
||||
runit $script
|
||||
|
||||
# If the current minute is divisible by the number of interval minutes, run
|
||||
# example: 600 is 5 minutes, it'll run at 0, 5, 10, 15, ... minutes
|
||||
elif [ $((minute % min)) = 0 ]; then
|
||||
runit $script
|
||||
|
||||
# If interval is an hour or more
|
||||
elif [ $min -gt 60 ]; then
|
||||
hr=$((i/60/60))
|
||||
|
||||
# If interval is 1 hour or less, run every hour on $run_minute
|
||||
if [ $hr -le 1 ] && [ $minute = $run_minute ]; then
|
||||
runit $script
|
||||
|
||||
# If the current hour is divisible by the number of interval hours, run
|
||||
# example: 21600 is 6 hours, it'll run at 0, 6, 12, 18 hours
|
||||
elif [ $((hour % hr)) = 0 ] && [ $minute = $run_minute ]; then
|
||||
runit $script
|
||||
|
||||
# If the number of hours is 24 or more, run every day at $run_hour:$run_minute
|
||||
elif [ $hr -ge 24 ] && [ $hour = $run_hour ] && [ $minute = $run_minute ]; then
|
||||
runit $script
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
4
extra/syslog_inputs_nix_ta/metadata/default.meta
Normal file
4
extra/syslog_inputs_nix_ta/metadata/default.meta
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
# Application-level permissions
|
||||
[]
|
||||
access = read : [ * ], write : [ admin , sc_admin ]
|
||||
export = system
|
||||
Loading…
Add table
Add a link
Reference in a new issue