-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Adding base syslog exporter - doesn't work yet Signed-off-by: Amit Schendel <[email protected]> * Adding fixes Signed-off-by: Amit Schendel <[email protected]> * Adding better logs Signed-off-by: Amit Schendel <[email protected]> * Changing default value of protocol Signed-off-by: Amit Schendel <[email protected]> * Fixing helm chart Signed-off-by: Amit Schendel <[email protected]> --------- Signed-off-by: Amit Schendel <[email protected]> Co-authored-by: Ben Hirschberg <[email protected]>
- Loading branch information
1 parent
85f4dce
commit 5238472
Showing
9 changed files
with
223 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| package exporters | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "log" | ||
| "log/syslog" | ||
| "os" | ||
| "time" | ||
|
|
||
| "github.com/crewjam/rfc5424" | ||
|
|
||
| "github.com/armosec/kubecop/pkg/engine/rule" | ||
| ) | ||
|
|
||
| // SyslogExporter is an exporter that sends alerts to syslog | ||
| type SyslogExporter struct { | ||
| writer *syslog.Writer | ||
| } | ||
|
|
||
| // InitSyslogExporter initializes a new SyslogExporter | ||
| func InitSyslogExporter(syslogHost string) *SyslogExporter { | ||
| if syslogHost == "" { | ||
| syslogHost = os.Getenv("SYSLOG_HOST") | ||
| if syslogHost == "" { | ||
| return nil | ||
| } | ||
| } | ||
|
|
||
| // Set default protocol to UDP | ||
| if os.Getenv("SYSLOG_PROTOCOL") == "" { | ||
| os.Setenv("SYSLOG_PROTOCOL", "udp") | ||
| } | ||
|
|
||
| writer, err := syslog.Dial(os.Getenv("SYSLOG_PROTOCOL"), syslogHost, syslog.LOG_ERR, "kubecop") | ||
| if err != nil { | ||
| log.Printf("failed to initialize syslog exporter: %v", err) | ||
| return nil | ||
| } | ||
|
|
||
| return &SyslogExporter{ | ||
| writer: writer, | ||
| } | ||
| } | ||
|
|
||
| // SendAlert sends an alert to syslog (RFC 5424) - https://tools.ietf.org/html/rfc5424 | ||
| func (se *SyslogExporter) SendAlert(failedRule rule.RuleFailure) { | ||
| message := rfc5424.Message{ | ||
| Priority: rfc5424.Error, | ||
| Timestamp: time.Unix(failedRule.Event().Timestamp, 0), | ||
| Hostname: failedRule.Event().PodName, | ||
| AppName: failedRule.Event().ContainerName, | ||
| ProcessID: fmt.Sprintf("%d", failedRule.Event().Pid), | ||
| StructuredData: []rfc5424.StructuredData{ | ||
| { | ||
| ID: "kubecop - General Event", | ||
| Parameters: []rfc5424.SDParam{ | ||
| { | ||
| Name: "rule", | ||
| Value: failedRule.Name(), | ||
| }, | ||
| { | ||
| Name: "priority", | ||
| Value: fmt.Sprintf("%d", failedRule.Priority()), | ||
| }, | ||
| { | ||
| Name: "error", | ||
| Value: failedRule.Error(), | ||
| }, | ||
| { | ||
| Name: "fix_suggestion", | ||
| Value: failedRule.FixSuggestion(), | ||
| }, | ||
| { | ||
| Name: "ppid", | ||
| Value: fmt.Sprintf("%d", failedRule.Event().Ppid), | ||
| }, | ||
| { | ||
| Name: "comm", | ||
| Value: failedRule.Event().Comm, | ||
| }, | ||
| { | ||
| Name: "uid", | ||
| Value: fmt.Sprintf("%d", failedRule.Event().Uid), | ||
| }, | ||
| { | ||
| Name: "gid", | ||
| Value: fmt.Sprintf("%d", failedRule.Event().Gid), | ||
| }, | ||
| { | ||
| Name: "namespace", | ||
| Value: failedRule.Event().Namespace, | ||
| }, | ||
| { | ||
| Name: "pod_name", | ||
| Value: failedRule.Event().PodName, | ||
| }, | ||
| { | ||
| Name: "container_name", | ||
| Value: failedRule.Event().ContainerName, | ||
| }, | ||
| { | ||
| Name: "container_id", | ||
| Value: failedRule.Event().ContainerID, | ||
| }, | ||
| { | ||
| Name: "cwd", | ||
| Value: failedRule.Event().Cwd, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| Message: []byte(failedRule.Error()), | ||
| } | ||
|
|
||
| _, err := message.WriteTo(se.writer) | ||
| if err != nil { | ||
| log.Printf("failed to send alert to syslog: %v", err) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| package exporters | ||
|
|
||
| import ( | ||
| "os" | ||
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/armosec/kubecop/pkg/engine/rule" | ||
| "github.com/kubescape/kapprofiler/pkg/tracing" | ||
| "github.com/stretchr/testify/assert" | ||
| "gopkg.in/mcuadros/go-syslog.v2" | ||
| ) | ||
|
|
||
| func setupServer() *syslog.Server { | ||
| channel := make(syslog.LogPartsChannel, 100) | ||
| handler := syslog.NewChannelHandler(channel) | ||
|
|
||
| server := syslog.NewServer() | ||
| server.SetFormat(syslog.Automatic) | ||
| server.SetHandler(handler) | ||
| server.ListenUDP("0.0.0.0:514") | ||
| server.Boot() | ||
|
|
||
| go func(channel syslog.LogPartsChannel) { | ||
| for logParts := range channel { | ||
| // Assert logParts is not nil | ||
| if assert.NotNil(nil, logParts) { | ||
| // Assert logParts["content"] is not nil | ||
| if assert.NotNil(nil, logParts["content"]) { | ||
| // Assert logParts["message"].(string) is not empty | ||
| assert.NotEmpty(nil, logParts["content"].(string)) | ||
| } | ||
| } else { | ||
| os.Exit(1) | ||
| } | ||
| } | ||
| }(channel) | ||
|
|
||
| go server.Wait() | ||
|
|
||
| return server | ||
| } | ||
|
|
||
| func TestSyslogExporter(t *testing.T) { | ||
| // Set up a mock syslog server | ||
| server := setupServer() | ||
| defer server.Kill() | ||
|
|
||
| // Set up environment variables for the exporter | ||
| syslogHost := "localhost:514" | ||
| os.Setenv("SYSLOG_HOST", syslogHost) | ||
| os.Setenv("SYSLOG_PROTOCOL", "udp") | ||
|
|
||
| // Initialize the syslog exporter | ||
| syslogExp := InitSyslogExporter("") | ||
| if syslogExp == nil { | ||
| t.Errorf("Expected syslogExp to not be nil") | ||
| } | ||
|
|
||
| // Send an alert | ||
| syslogExp.SendAlert(&rule.R0001UnexpectedProcessLaunchedFailure{ | ||
| RuleName: "testrule", | ||
| Err: "Application profile is missing", | ||
| FailureEvent: &tracing.ExecveEvent{GeneralEvent: tracing.GeneralEvent{ | ||
| ContainerName: "testcontainer", ContainerID: "testcontainerid", Namespace: "testnamespace", PodName: "testpodname"}}, | ||
| }) | ||
|
|
||
| // Allow some time for the message to reach the mock syslog server | ||
| time.Sleep(200 * time.Millisecond) | ||
| } |