diff options
| -rw-r--r-- | tasks/general.yml | 28 | ||||
| -rw-r--r-- | templates/etc_crontab.j2 | 5 | ||||
| -rw-r--r-- | templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 | 14 | ||||
| -rw-r--r-- | templates/usr_local_etc_pylogsentinel.conf.j2 | 13 |
4 files changed, 60 insertions, 0 deletions
diff --git a/tasks/general.yml b/tasks/general.yml index df24be2..b561d2a 100644 --- a/tasks/general.yml +++ b/tasks/general.yml @@ -8,6 +8,8 @@ - jq - curl - bash + - python + - py311-pip - name: Set up periodic.conf template: @@ -44,6 +46,32 @@ name: auditd state: started +- name: Check if pylogsentinel is installed + shell: pip show pylogsentinel + register: pylogsentinel_check + failed_when: false + changed_when: false + +- name: Install pylogsentinel + shell: pip install pylogsentinel==0.2.1 --force --no-input + when: pylogsentinel_check.rc != 0 + +- name: Install pylogsentinel.conf + template: + src: usr_local_etc_pylogsentinel.conf.j2 + dest: /usr/local/etc/pylogsentinel.conf + owner: root + group: wheel + mode: "0644" + +- name: Install pylogsentinel-batch-email.sh + template: + src: usr_local_bin_pylogsentinel-batch-email.sh.j2 + dest: /usr/local/bin/pylogsentinel-batch-email.sh + owner: root + group: wheel + mode: "0755" + - name: Set up crontab template: src: etc_crontab.j2 diff --git a/templates/etc_crontab.j2 b/templates/etc_crontab.j2 index affdf7d..de1f3c6 100644 --- a/templates/etc_crontab.j2 +++ b/templates/etc_crontab.j2 @@ -25,3 +25,8 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin 5 3 * * * root logto /var/log/backup /usr/local/bin/backup snapshot prune-local # Send backup snapshots to remote every third day at 4:05 AM 5 4 */3 * * root logto /var/log/backup /usr/local/bin/backup send-to-remote prune-remote notify + +# Run pylogmonitor +*/10 * * * * root python -m pylogsentinel +# Run pylogsentinel batch job once a day +5 6 * * * root /usr/local/bin/pylogsentinel-batch-email.sh diff --git a/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 b/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 new file mode 100644 index 0000000..d28efd9 --- /dev/null +++ b/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 @@ -0,0 +1,14 @@ +#!/bin/sh + +FILE=/tmp/pylogsentinel.daily + +if [ ! -f "$FILE" ]; then + echo "Nothing to do" + exit 0 +fi + +echo "Sending email" +cat "$FILE" | mail -s "pylogsentinel alert batch" root + +echo "Removing batch file" +rm "$FILE" diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2 new file mode 100644 index 0000000..8eb154a --- /dev/null +++ b/templates/usr_local_etc_pylogsentinel.conf.j2 @@ -0,0 +1,13 @@ +[system] +state_dir = /var/run/pylogsentinel +max_block_size = 10M + +[logs] +cmd = find / -type d -path '*/var/log' + +[action.default] +cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily + +[rule.error] +description = Error-like conditions +pattern = /(error|fatal|exception|kill|crash)/i |