From 28b9f0736e43d188abc8a5b63eee1e428cca2935 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Wed, 15 Oct 2025 09:21:37 +0300
Subject: Add pylogsentinel

---
 tasks/general.yml                                  | 28 ++++++++++++++++++++++
 templates/etc_crontab.j2                           |  5 ++++
 .../usr_local_bin_pylogsentinel-batch-email.sh.j2  | 14 +++++++++++
 templates/usr_local_etc_pylogsentinel.conf.j2      | 13 ++++++++++
 4 files changed, 60 insertions(+)
 create mode 100644 templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
 create mode 100644 templates/usr_local_etc_pylogsentinel.conf.j2

diff --git a/tasks/general.yml b/tasks/general.yml
index df24be2..b561d2a 100644
--- a/tasks/general.yml
+++ b/tasks/general.yml
@@ -8,6 +8,8 @@
     - jq
     - curl
     - bash
+    - python
+    - py311-pip
 
 - name: Set up periodic.conf
   template:
@@ -44,6 +46,32 @@
     name: auditd
     state: started
 
+- name: Check if pylogsentinel is installed
+  shell: pip show pylogsentinel
+  register: pylogsentinel_check
+  failed_when: false
+  changed_when: false
+
+- name: Install pylogsentinel
+  shell: pip install pylogsentinel==0.2.1 --force --no-input
+  when: pylogsentinel_check.rc != 0
+
+- name: Install pylogsentinel.conf
+  template:
+    src: usr_local_etc_pylogsentinel.conf.j2
+    dest: /usr/local/etc/pylogsentinel.conf
+    owner: root
+    group: wheel
+    mode: "0644"
+
+- name: Install pylogsentinel-batch-email.sh
+  template:
+    src: usr_local_bin_pylogsentinel-batch-email.sh.j2
+    dest: /usr/local/bin/pylogsentinel-batch-email.sh
+    owner: root
+    group: wheel
+    mode: "0755"
+
 - name: Set up crontab
   template:
     src: etc_crontab.j2
diff --git a/templates/etc_crontab.j2 b/templates/etc_crontab.j2
index affdf7d..de1f3c6 100644
--- a/templates/etc_crontab.j2
+++ b/templates/etc_crontab.j2
@@ -25,3 +25,8 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 5       3       *       *       *       root    logto /var/log/backup /usr/local/bin/backup snapshot prune-local
 # Send backup snapshots to remote every third day at 4:05 AM
 5       4       */3     *       *       root    logto /var/log/backup /usr/local/bin/backup send-to-remote prune-remote notify
+
+# Run pylogmonitor
+*/10    *       *       *       *       root    python -m pylogsentinel
+# Run pylogsentinel batch job once a day
+5       6       *       *       *       root    /usr/local/bin/pylogsentinel-batch-email.sh
diff --git a/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2 b/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
new file mode 100644
index 0000000..d28efd9
--- /dev/null
+++ b/templates/usr_local_bin_pylogsentinel-batch-email.sh.j2
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+FILE=/tmp/pylogsentinel.daily
+
+if [ ! -f "$FILE" ]; then
+    echo "Nothing to do"
+    exit 0
+fi
+
+echo "Sending email"
+cat "$FILE" | mail -s "pylogsentinel alert batch" root
+
+echo "Removing batch file"
+rm "$FILE"
diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2
new file mode 100644
index 0000000..8eb154a
--- /dev/null
+++ b/templates/usr_local_etc_pylogsentinel.conf.j2
@@ -0,0 +1,13 @@
+[system]
+state_dir = /var/run/pylogsentinel
+max_block_size = 10M
+
+[logs]
+cmd = find / -type d -path '*/var/log'
+
+[action.default]
+cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily
+
+[rule.error]
+description = Error-like conditions
+pattern = /(error|fatal|exception|kill|crash)/i
-- 
cgit v1.3