Documentation
¶
Overview ¶
Package logger creates an osquery logging plugin.
See https://osquery.readthedocs.io/en/latest/development/logger-plugins/ for more.
Index ¶
- type LogFunc
- type LogType
- type Plugin
- func (t *Plugin) Call(ctx context.Context, request osquery.ExtensionPluginRequest) osquery.ExtensionResponse
- func (t *Plugin) Name() string
- func (t *Plugin) Ping() osquery.ExtensionStatus
- func (t *Plugin) RegistryName() string
- func (t *Plugin) Routes() osquery.ExtensionPluginResponse
- func (t *Plugin) Shutdown()
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type LogFunc ¶
LogFunc is the logger function used by an osquery Logger plugin.
The LogFunc should log the provided result string. The LogType argument can be optionally used to log differently depending on the type of log received. The context argument can optionally be used for cancellation in long-running operations.
type LogType ¶
type LogType int
LogType encodes the type of log osquery is outputting.
const ( // LogTypeString to log a string LogTypeString LogType = iota // LogTypeSnapshot to log snapshot results LogTypeSnapshot // LogTypeHealth for health details logging LogTypeHealth // LogTypeInit for init details logging LogTypeInit // LogTypeStatus for differential results status logging LogTypeStatus )
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is an osquery logger plugin. The Plugin struct implements the OsqueryPlugin interface.
func NewPlugin ¶
NewPlugin takes a value that implements LoggerPlugin and wraps it with the appropriate methods to satisfy the OsqueryPlugin interface. Use this to easily create plugins implementing osquery loggers.
func (*Plugin) Call ¶
func (t *Plugin) Call(ctx context.Context, request osquery.ExtensionPluginRequest) osquery.ExtensionResponse
Call is invoked to log the specified request details. Depending on the type of logger implementation, contents of the requests can be saved to a file, sent to remote destination etc after necessary formatting.
func (*Plugin) Ping ¶
func (t *Plugin) Ping() osquery.ExtensionStatus
Ping returns static "OK" response.
func (*Plugin) RegistryName ¶
RegistryName always returns static string "logger" for logger plugins.
func (*Plugin) Routes ¶
func (t *Plugin) Routes() osquery.ExtensionPluginResponse
Routes returns empty plugin response for logger plugins.
Source Files