Syslog plugin #36
Syslog plugin #36
Conversation
| class SyslogData(DataModel): | ||
| """Data model for in band syslog logs""" | ||
|
|
||
| syslog_logs: int = 0 |
There was a problem hiding this comment.
@landrews-amd should i be keeping track of the files collected rather than the number of logs collected? (similar to the dmesg PR?)
There was a problem hiding this comment.
Yes we should include the log data itself here.
| def _shell_quote(self, s: str) -> str: | ||
| """single-quote fix.""" | ||
| return "'" + s.replace("'", "'\"'\"'") + "'" |
There was a problem hiding this comment.
This should be put into utils.py since it is being used in a few different places.
| def _nice_syslog_name(self, path: str) -> str: | ||
| """Map path to filename | ||
| Args: | ||
| path (str): file path | ||
| Returns: | ||
| str: new local filename | ||
| """ | ||
| prefix = "rotated_" | ||
| base = path.rstrip("/").rsplit("/", 1)[-1] | ||
|
|
||
| if base == "syslog": | ||
| return f"{prefix}syslog.log" | ||
|
|
||
| m = re.fullmatch(r"syslog\.(\d+)\.gz", base) | ||
| if m: | ||
| return f"{prefix}syslog.{m.group(1)}.gz.log" | ||
|
|
||
| m = re.fullmatch(r"syslog\.(\d+)", base) | ||
| if m: | ||
| return f"{prefix}syslog.{m.group(1)}.log" | ||
|
|
||
| middle = base[:-3] if base.endswith(".gz") else base | ||
| return f"{prefix}{middle}.log" |
There was a problem hiding this comment.
This may also be good to make more generic and move to utils since the same logic is used for the dmesg files.
| self.result.artifacts.append( | ||
| TextFileArtifact(filename=fname, contents=res.stdout) | ||
| ) | ||
| collected_logs.append( | ||
| {"path": p, "as": fname, "bytes": len(res.stdout.encode("utf-8", "ignore"))} | ||
| ) |
There was a problem hiding this comment.
I think it will be better to store the artifacts as part of the data model rather than in artifacts in this case. This more closely aligns with the pattern of other collectors and will allow the logs to be analyzed in the future if need be.
| class SyslogData(DataModel): | ||
| """Data model for in band syslog logs""" | ||
|
|
||
| syslog_logs: int = 0 |
There was a problem hiding this comment.
Yes we should include the log data itself here.
Collecting system logs from /var/log/syslog*. Collection only, this plugin does not have an analyzer part yet.
Sample run: