initial commit

.github/workflows/docker-build.yml

@@ -0,0 +1,20 @@
+name: Build and publish Docker image
+
+on:
+  push:
+    branches:
+      - 'master'
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: valitydev/action-deploy-docker@v2
+        with:
+          registry-username: ${{ github.actor }}
+          registry-access-token: ${{ secrets.GITHUB_TOKEN }}
+          platforms: linux/amd64,linux/arm64

Dockerfile

@@ -0,0 +1,11 @@
+# syntax=docker/dockerfile:1.2
+
+FROM --platform=${TARGETPLATFORM} alpine:latest as base
+
+RUN apk add --no-cache inotify-tools bash coreutils
+
+COPY monitor.sh /usr/local/bin/monitor
+
+RUN chmod +x /usr/local/bin/monitor
+
+CMD ["/usr/local/bin/monitor"]

README.MD

@@ -0,0 +1,3 @@
+Манифест образа для решения задачи с выводом в stdout конкурентных записей логов modsecurity в ingress-controller.
+
+Скрипт ловит события на создание директорий и файлов по пути, переданном аргументом (дефолтовый путь /var/log/audit), конвертирует содержимое в utf-8 и выводит в stdout. Удаляет пустые директории старше 2 минут

monitor.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# directory to monitor
+MONITOR_DIR=${1:-"/var/log/audit"}
+
+process_file() {
+  local file="$1"
+  iconv -s -t utf-8 $file
+  rm -f "$file"
+}
+
+process_path() {
+  local path="$1"
+  if [ -f "$path" ]; then
+    process_file "$path"
+  elif [ -d "$path" ]; then
+    for entry in "$path"/*; do
+      if [ -f "$entry" ]; then
+        process_file "$entry"
+      elif [ -d "$entry" ]; then
+        process_path "$entry"
+      fi
+    done
+    
+    # remove dirs older than 2 mins
+    find "${MONITOR_DIR}" -mindepth 1 -empty -mmin +2 -delete -type d
+  fi
+}
+
+export -f process_file
+
+# read already existing files if any
+find ${MONITOR_DIR} -type f -exec bash -c 'process_file "$0"' {} \;
+
+# monitor directory and its subdirectories for new files
+inotifywait -q -m -r -e create --format '%w%f' "${MONITOR_DIR}" | while read path; do
+  process_path "$path" &
+done