kazu634
/
itamae
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Modify `promtail` config for `sudo` logs.

This commit is contained in:
Kazuhiro MUSASHI 2020-10-12 14:01:42 +09:00
parent 57d21b0a40
commit 6b7b0a0844
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cookbooks/promtail/templates/etc/promtail/base.yaml
View File

@ -32,7 +32,7 @@ scrape_configs:
selector: '{job="sudo"} |~ "/bin/sh"' selector: '{job="sudo"} |~ "/bin/sh"'
stages: stages:
- drop: - drop:
expression: (CRON|sshd|session) expression: (CRON|sshd|session|securetty)
- regex: - regex:
expression: '^(?P<timestamp>\w+ +[0-9]+ [0-9]+:[0-9]+:[0-9]+) [^ ]+ sudo: +(?P<user>[^ ]+) : TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>[^ ]+) ; USER=(?P<foo>[^ ]+) ; COMMAND=(?P<cmd>.+)$' expression: '^(?P<timestamp>\w+ +[0-9]+ [0-9]+:[0-9]+:[0-9]+) [^ ]+ sudo: +(?P<user>[^ ]+) : TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>[^ ]+) ; USER=(?P<foo>[^ ]+) ; COMMAND=(?P<cmd>.+)$'
@ -59,7 +59,7 @@ scrape_configs:
selector: '{job="sudo"} !~ "/bin/sh"' selector: '{job="sudo"} !~ "/bin/sh"'
stages: stages:
- drop: - drop:
expression: (CRON|sshd|session) expression: (CRON|sshd|session|securetty)
- regex: - regex:
expression: '^(?P<timestamp>\w+ +[0-9]+ [0-9]+:[0-9]+:[0-9]+) [^ ]+ sudo: +(?P<user>[^ ]+) : TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>[^ ]+) ; USER=(?P<foo>[^ ]+) ; COMMAND=(?P<cmd>.+)$' expression: '^(?P<timestamp>\w+ +[0-9]+ [0-9]+:[0-9]+:[0-9]+) [^ ]+ sudo: +(?P<user>[^ ]+) : TTY=(?P<tty>[^ ]+) ; PWD=(?P<pwd>[^ ]+) ; USER=(?P<foo>[^ ]+) ; COMMAND=(?P<cmd>.+)$'