class Fluent::Auditd
Constants
- DOCKER
- ENV_HOSTNAME
- IN_EVENT_TYPE
- IN_HOST_AUID
- IN_HOST_HOSTNAME
- IN_HOST_PID
Keys as found in raw audit.log messsages
- IN_HOST_SELINUX_LABEL
- IN_HOST_SESSION
- IN_HOST_UID
- IN_VM_AUID
- IN_VM_EXE
- IN_VM_HOSTNAME
- IN_VM_IMAGE
- IN_VM_OPERATION
- IN_VM_PID
- IN_VM_REASON
- IN_VM_RESULT
- IN_VM_USER
- OUT_HOST_AUID
- OUT_HOST_EXE
- OUT_HOST_HOSTNAME
- OUT_HOST_PID
Keys used in Origin Aggregated Logging schema
- OUT_HOST_SELINUX_LABEL
- OUT_HOST_SESSION
- OUT_HOST_UID
- OUT_VM_AUID
- OUT_VM_COMMAND
- OUT_VM_CONT_ID
- OUT_VM_IMAGE
- OUT_VM_OPERATION
- OUT_VM_PID
- OUT_VM_REASON
- OUT_VM_RESULT
- OUT_VM_USER
- SYSTEMD
- TIME
- TRUSTED
- VIRT_CONTROL
Public Instance Methods
parse_auditd_line(line)
click to toggle source
Takes one line from audit.log and returns hash that fits the OAL format. Messages of other types than 'virt_control' are ignored.
# File lib/fluent/plugin/auditd.rb, line 56 def parse_auditd_line(line) if filter_virt_control(line) event = {} docker = {} if (metadata = /(?<g1>.*?) msg='(?<g2>.*?)'/.match(line)) && !metadata['g1'].nil? && !metadata['g2'].nil? parse_metadata(event, metadata['g1'].split) parse_msg(docker, metadata['g2'].split) event[IN_EVENT_TYPE] = docker else raise AuditdParserException, "Couldn't parse message: #{line}" end return normalize(event) end return nil end
Private Instance Methods
dedup_exe(field)
click to toggle source
# File lib/fluent/plugin/auditd.rb, line 136 def dedup_exe(field) event_exe = field docker_command = nil if field.kind_of?(Array) field.each do |f| if /dockerd-current/.match(f) event_exe = f else docker_command = f end end end return event_exe, docker_command end
filter_virt_control(line)
click to toggle source
# File lib/fluent/plugin/auditd.rb, line 74 def filter_virt_control(line) return (type = /^type=(?<type>[a-zA-Z_]+)/.match(line)) && type['type'] == VIRT_CONTROL && \ /\/usr\/bin\/dockerd-current/.match(line) end
insert_or_merge(result, key, value)
click to toggle source
# File lib/fluent/plugin/auditd.rb, line 94 def insert_or_merge(result, key, value) if result[key].nil? result[key] = value elsif result[key].kind_of?(Array) result[key] << value else temp = result[key] result[key] = [value, temp] end end
normalize(target)
click to toggle source
# File lib/fluent/plugin/auditd.rb, line 105 def normalize(target) event = {} event[TIME] = Time.at(target[TIME].to_f).utc.to_datetime.rfc3339(6) event[OUT_HOST_HOSTNAME] = ENV[ENV_HOSTNAME] unless ENV[ENV_HOSTNAME].nil? event[SYSTEMD] = { TRUSTED => {} } event[SYSTEMD][TRUSTED][OUT_HOST_PID] = target[IN_HOST_PID] unless target[IN_HOST_PID].nil? event[SYSTEMD][TRUSTED][OUT_HOST_UID] = target[IN_HOST_UID] unless target[IN_HOST_UID].nil? event[SYSTEMD][TRUSTED][OUT_HOST_AUID] = target[IN_HOST_AUID] unless target[IN_HOST_AUID].nil? event[SYSTEMD][TRUSTED][OUT_HOST_SESSION] = target[IN_HOST_SESSION] unless target[IN_HOST_SESSION].nil? event[SYSTEMD][TRUSTED][OUT_HOST_SELINUX_LABEL] = target[IN_HOST_SELINUX_LABEL] unless target[IN_HOST_SELINUX_LABEL].nil? event[DOCKER] = {} event[DOCKER][OUT_VM_AUID] = target[IN_EVENT_TYPE][IN_VM_AUID] unless target[IN_EVENT_TYPE][IN_VM_AUID].nil? event[DOCKER][OUT_VM_CONT_ID] = target[IN_EVENT_TYPE][IN_VM_HOSTNAME] unless target[IN_EVENT_TYPE][IN_VM_HOSTNAME].nil? event[DOCKER][OUT_VM_IMAGE] = target[IN_EVENT_TYPE][IN_VM_IMAGE] unless target[IN_EVENT_TYPE][IN_VM_IMAGE].nil? event[DOCKER][OUT_VM_PID] = target[IN_EVENT_TYPE][IN_VM_PID] unless target[IN_EVENT_TYPE][IN_VM_PID].nil? event[DOCKER][OUT_VM_USER] = target[IN_EVENT_TYPE][IN_VM_USER] unless target[IN_EVENT_TYPE][IN_VM_USER].nil? event[DOCKER][OUT_VM_REASON] = target[IN_EVENT_TYPE][IN_VM_REASON] unless target[IN_EVENT_TYPE][IN_VM_REASON].nil? event[DOCKER][OUT_VM_OPERATION] = target[IN_EVENT_TYPE][IN_VM_OPERATION] unless target[IN_EVENT_TYPE][IN_VM_OPERATION].nil? event[DOCKER][OUT_VM_RESULT] = target[IN_EVENT_TYPE][IN_VM_RESULT] unless target[IN_EVENT_TYPE][IN_VM_RESULT].nil? # raw audit.log duplicates 'exe' key if !target[IN_EVENT_TYPE][IN_VM_EXE].nil? exe_a = dedup_exe(target[IN_EVENT_TYPE][IN_VM_EXE]) event[SYSTEMD][TRUSTED][OUT_HOST_EXE] = exe_a[0] unless exe_a[0].nil? event[DOCKER][OUT_VM_COMMAND] = exe_a[1] unless exe_a[1].nil? end return event end
parse_metadata(result, metadata)
click to toggle source
# File lib/fluent/plugin/auditd.rb, line 79 def parse_metadata(result, metadata) result[TIME] = metadata[1].sub(/msg=audit\((?<g1>.*):\d+\):/, '\k<g1>') for i in 2...metadata.length pair = metadata[i].split('=') insert_or_merge(result, pair[0], pair[1]) unless pair[1].nil? or pair[1] == '?' end end
parse_msg(result, msg)
click to toggle source
# File lib/fluent/plugin/auditd.rb, line 87 def parse_msg(result, msg) msg.each do |part| pair = part.split('=') insert_or_merge(result, pair[0], pair[1]) unless pair[1].nil? or pair[1] == '?' end end