mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 10:23:54 +00:00
ce2ba6d9c8
The initialization of a logger plugin was confusing. The 'init' step was introduced to allow a daemon to buffer status events before a logger plugin is determined by external/remote configuration. The buffered statuses could then be transferred via a medium other than Glog (the default). To determine if Glog should continue to write statuses to the filesystem the 'init' method returned a Status. Logger plugins should now use a feature method override to select how status logs should be handled.
79 lines
2.2 KiB
C++
79 lines
2.2 KiB
C++
/*
|
|
* Copyright (c) 2014-present, Facebook, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This source code is licensed under the BSD-style license found in the
|
|
* LICENSE file in the root directory of this source tree. An additional grant
|
|
* of patent rights can be found in the PATENTS file in the same directory.
|
|
*
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <osquery/dispatcher.h>
|
|
#include <osquery/logger.h>
|
|
|
|
#include "osquery/logger/plugins/buffered.h"
|
|
|
|
namespace osquery {
|
|
|
|
/**
|
|
* @brief A log forwarder thread flushing database-buffered logs.
|
|
*
|
|
* The TLSLogForwarder flushes buffered result and status logs based
|
|
* on CLI/options settings. If an enrollment key is set (and checked) during
|
|
* startup, this Dispatcher service is started.
|
|
*/
|
|
class TLSLogForwarder : public BufferedLogForwarder {
|
|
public:
|
|
explicit TLSLogForwarder(const std::string& node_key);
|
|
|
|
protected:
|
|
Status send(std::vector<std::string>& log_data,
|
|
const std::string& log_type) override;
|
|
|
|
/// Receive an enrollment/node key from the backing store cache.
|
|
std::string node_key_;
|
|
|
|
/// Endpoint URI
|
|
std::string uri_;
|
|
|
|
private:
|
|
friend class TLSLoggerTests;
|
|
};
|
|
|
|
class TLSLoggerPlugin : public LoggerPlugin {
|
|
public:
|
|
/**
|
|
* @brief The osquery logger initialization method.
|
|
*
|
|
* LoggerPlugin::init is optionally used by logger plugins to receive a
|
|
* buffer of status logs generated between application start and logger
|
|
* initialization. TLSLoggerPlugin will further buffer these logs into the
|
|
* backing store. They will flush to a TLS endpoint under normal conditions
|
|
* in a supporting/asynchronous thread.
|
|
*/
|
|
void init(const std::string& name,
|
|
const std::vector<StatusLogLine>& log) override;
|
|
|
|
/// Setup node key and worker thread for sending logs.
|
|
Status setUp() override;
|
|
|
|
bool usesLogStatus() override { return true; }
|
|
|
|
protected:
|
|
/// Log a result string. This is the basic catch-all for snapshots and events.
|
|
Status logString(const std::string& s) override;
|
|
|
|
/// Log a status (ERROR/WARNING/INFO) message.
|
|
Status logStatus(const std::vector<StatusLogLine>& log) override;
|
|
|
|
private:
|
|
/// Forwarder that buffers/sends logs. Runs in a Dispatcher thread.
|
|
std::shared_ptr<TLSLogForwarder> forwarder_{nullptr};
|
|
|
|
private:
|
|
friend class TLSLoggerTests;
|
|
};
|
|
}
|