mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 01:55:20 +00:00
c2019aa648
Summary: Pull Request resolved: https://github.com/facebook/osquery/pull/5485 Initial steps to separate plugins from the rest of osquery. On the long run separating plugins will provide more build flexibility such that we can have configurable builds that include only the bits and pieces we actually ne er deployment. Reducing the attack surface, possibility of supply chain attacks, binary size, etc. Move numeric monitoring Reviewed By: guliashvili Differential Revision: D14259758 fbshipit-source-id: 1016fc28a0052417d658b6ce1cb3368e56597a7b
96 lines
2.7 KiB
C++
96 lines
2.7 KiB
C++
/**
|
|
* Copyright (c) 2014-present, Facebook, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This source code is licensed in accordance with the terms specified in
|
|
* the LICENSE file found in the root directory of this source tree.
|
|
*/
|
|
|
|
#include <boost/format.hpp>
|
|
|
|
#include <osquery/flags.h>
|
|
#include <osquery/registry_factory.h>
|
|
#include <osquery/utils/config/default_paths.h>
|
|
#include <plugins/numeric_monitoring/filesystem.h>
|
|
|
|
namespace fs = boost::filesystem;
|
|
|
|
namespace osquery {
|
|
|
|
FLAG(string,
|
|
numeric_monitoring_filesystem_path,
|
|
OSQUERY_LOG_HOME "numeric_monitoring.log",
|
|
"File to dump numeric monitoring records one per line. "
|
|
"The format of the line is <PATH><TAB><VALUE><TAB><TIMESTAMP>.");
|
|
|
|
REGISTER(NumericMonitoringFilesystemPlugin,
|
|
monitoring::registryName(),
|
|
"filesystem");
|
|
|
|
NumericMonitoringFilesystemPlugin::NumericMonitoringFilesystemPlugin()
|
|
: NumericMonitoringFilesystemPlugin(
|
|
FLAGS_numeric_monitoring_filesystem_path) {}
|
|
|
|
NumericMonitoringFilesystemPlugin::NumericMonitoringFilesystemPlugin(
|
|
fs::path log_file_path
|
|
)
|
|
: line_format_{
|
|
monitoring::recordKeys().path,
|
|
monitoring::recordKeys().value,
|
|
monitoring::recordKeys().timestamp,
|
|
monitoring::recordKeys().sync,
|
|
}
|
|
, separator_{'\t'}
|
|
, log_file_path_(
|
|
std::move(log_file_path)
|
|
)
|
|
{
|
|
}
|
|
|
|
Status NumericMonitoringFilesystemPlugin::formTheLine(
|
|
std::string& line, const PluginRequest& request) const {
|
|
for (const auto& key : line_format_) {
|
|
auto it = request.find(key);
|
|
if (it == request.end()) {
|
|
return Status(1, "Missing mandatory request field " + key);
|
|
}
|
|
line.append(it->second).push_back(separator_);
|
|
}
|
|
// remove last separator
|
|
line.pop_back();
|
|
return Status();
|
|
}
|
|
|
|
Status NumericMonitoringFilesystemPlugin::call(const PluginRequest& request,
|
|
PluginResponse& response) {
|
|
if (!isSetUp()) {
|
|
return Status(1, "NumericMonitoringFilesystemPlugin is not set up");
|
|
}
|
|
auto line = std::string{};
|
|
auto status = formTheLine(line, request);
|
|
if (status.ok()) {
|
|
std::unique_lock<std::mutex> lock(output_file_mutex_);
|
|
output_file_stream_ << line << std::endl;
|
|
}
|
|
return status;
|
|
}
|
|
|
|
Status NumericMonitoringFilesystemPlugin::setUp() {
|
|
output_file_stream_.open(log_file_path_.native(),
|
|
std::ios::out | std::ios::app | std::ios::binary);
|
|
if (!output_file_stream_.is_open()) {
|
|
return Status(
|
|
1,
|
|
boost::str(boost::format(
|
|
"Could not open file %s for numeric monitoring logs") %
|
|
log_file_path_));
|
|
}
|
|
return Status();
|
|
}
|
|
|
|
bool NumericMonitoringFilesystemPlugin::isSetUp() const {
|
|
return output_file_stream_.is_open();
|
|
}
|
|
|
|
} // namespace osquery
|