logging

package
v0.5.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 12, 2026 License: MIT Imports: 34 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// GraylogVersion - GELF spec version
	GraylogVersion = "1.1"
	// GraylogLevel - Log Level (informational)
	GraylogLevel = 6
	// GraylogMethod - Method to send
	GraylogMethod = "POST"
)
View Source 
const (
	// LogstashTCP for TCP inputs
	LogstashTCP = "tcp"
	// LogstashUDP for UDP inputs
	LogstashUDP = "udp"
	// LogstashHTTP for HTTP inputs
	LogstashHTTP = "http"
)
View Source 
const (
	// LogstashMethod Method to send requests
	LogstashMethod = "POST"
	// LogstashContentType Content Type for requests
	LogstashContentType = "application/json"
)
View Source 
const (
	// SplunkMethod Method to send requests
	SplunkMethod = "POST"
	// SplunkContentType Content Type for requests
	SplunkContentType = "application/json"
)
View Source 
const (
	// NotReturned - Value not returned from agent
	NotReturned = "not returned"
	// Mismatched - Value mismatched in log entries
	Mismatched = "mismatched"
)
View Source 
const (
	// Default time format for loggers
	LoggerTimeFormat string = "2006-01-02T15:04:05.999Z07:00"
)

Variables

This section is empty.

Functions

func CreateDebugHTTP added in v0.4.5 

func CreateDebugHTTP(cfg config.LocalLogger) (*zerolog.Logger, error)

CreateDebugHTTP to initialize the debug HTTP logger

func GetNodeLogs added in v0.5.2 

func GetNodeLogs(db *gorm.DB, logType, env, uuid string, since time.Time, limit int, search string) ([]map[string]any, error)

GetNodeLogs retrieves recent log entries for a single node (status or result). logType must be "status" or "result". Results are ordered by created_at DESC. If since is non-zero only entries created strictly after that time are returned. limit is clamped to [1, 1000].

search is an optional free-text filter (substring, case-insensitive). It runs as a `LIKE` against the human-readable text columns of the row:

  • status: line + message + filename
  • result: name + action + columns (the serialized JSON of matched fields)

Empty search disables the filter — same behavior as a missing param.

The `LIKE` is unindexed today. If the result_data / status_data tables grow large enough to make this slow, an operator-side workaround is to narrow `since` first, which keeps the matched row count small.

func GetNodeResultBucketed added in v0.5.2 

func GetNodeResultBucketed(db *gorm.DB, env, uuid string, since time.Time, bucketSeconds int) ([]dbutil.BucketedRow, error)

GetNodeResultBucketed mirrors GetNodeStatusBucketed for osquery_result_data.

func GetNodeResultTimestamps added in v0.5.2 

func GetNodeResultTimestamps(db *gorm.DB, env, uuid string, since time.Time) ([]time.Time, error)

func GetNodeStatusBucketed added in v0.5.2 

func GetNodeStatusBucketed(db *gorm.DB, env, uuid string, since time.Time, bucketSeconds int) ([]dbutil.BucketedRow, error)

GetNodeStatusBucketed returns per-bucket row counts for `uuid` in `env` since `since`, with buckets aligned to `bucketSeconds`. The SQL pushes the histogram into the database (one GROUP BY) instead of shipping every timestamp to the API process — orders of magnitude less wire traffic on chatty nodes.

func GetNodeStatusTimestamps added in v0.5.2 

func GetNodeStatusTimestamps(db *gorm.DB, env, uuid string, since time.Time) ([]time.Time, error)

GetNodeStatusTimestamps and GetNodeResultTimestamps return just the CreatedAt column for every status/result log row a given node has shipped since `since`. Used by the per-node activity heatmap so it can bucket on the API side without dragging the row bodies across the wire.

Returning a slice of timestamps (rather than int64 epochs) keeps the downstream bucketing arithmetic in Go's time domain, which is what the rest of cmd/api/handlers/stats.go uses.

func GetQueryResults added in v0.5.2 

func GetQueryResults(db *gorm.DB, name string, since time.Time, page, pageSize int) ([]map[string]any, int64, error)

GetQueryResults retrieves rows of query result data (one per node) for a single query name. Results are ordered by created_at ASC (oldest first — query results are append-only). If since is non-zero only rows created strictly after that time are returned. page is 1-indexed; pageSize is clamped to [1, 1000]; pageSize <= 0 defaults to 100. Returns the page items, total matching rows, and any error.

func LoadLogstash 

func LoadLogstash(file string) (config.LogstashLogger, error)

LoadLogstash - Function to load the Logstash configuration from JSON file

func StreamQueryResults added in v0.5.2 

func StreamQueryResults(db *gorm.DB, name string, fn func(OsqueryQueryData) error) error

StreamQueryResults invokes fn for each row of query result data for `name`, ordered by created_at ASC. Rows are read via a cursor so memory usage stays bounded — used by the CSV exporter. fn may return an error to stop iteration; that error is returned by StreamQueryResults.

Types

type GraylogMessage 

type GraylogMessage struct {
	Version      string `json:"version"`
	Host         string `json:"host"`
	ShortMessage string `json:"short_message"`
	Timestamp    int64  `json:"timestamp"`
	Level        uint   `json:"level"`
	Environment  string `json:"_environment"`
	Type         string `json:"_type"`
	UUID         string `json:"_uuid"`
}

GraylogMessage to handle log format to be sent to Graylog

type LoggerDB 

type LoggerDB struct {
	Database *backend.DBManager
	Enabled  bool
}

LoggerDB will be used to log data using a database

func CreateLoggerDB 

func CreateLoggerDB(backend *backend.DBManager) (*LoggerDB, error)

CreateLoggerDB to initialize the logger without reading a config file

func CreateLoggerDBConfig 

func CreateLoggerDBConfig(dbConfig *config.YAMLConfigurationDB) (*LoggerDB, error)

CreateLoggerDB to initialize the logger without reading a config file

func (*LoggerDB) CleanQueryLogs 

func (logDB *LoggerDB) CleanQueryLogs(entries int64) error

CleanQueryLogs will delete old query logs

func (*LoggerDB) CleanResultLogs 

func (logDB *LoggerDB) CleanResultLogs(environment string, seconds int64) error

CleanResultLogs will delete old status logs

func (*LoggerDB) CleanStatusLogs 

func (logDB *LoggerDB) CleanStatusLogs(environment string, seconds int64) error

CleanStatusLogs will delete old status logs

func (*LoggerDB) Log 

func (logDB *LoggerDB) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to the configured DB

func (*LoggerDB) Query 

func (logDB *LoggerDB) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to the configured DB

func (*LoggerDB) QueryLogs 

func (logDB *LoggerDB) QueryLogs(name string) ([]OsqueryQueryData, error)

QueryLogs will retrieve all query logs

func (*LoggerDB) Result 

func (logDB *LoggerDB) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to the configured DB

func (*LoggerDB) ResultLogs 

func (logDB *LoggerDB) ResultLogs(uuid, environment string, seconds int64) ([]OsqueryResultData, error)

ResultLogs will retrieve all result logs

func (*LoggerDB) ResultLogsLimit 

func (logDB *LoggerDB) ResultLogsLimit(uuid, environment string, limit int) ([]OsqueryResultData, error)

ResultLogsLimit will retrieve a limited number of result logs

func (*LoggerDB) Settings 

func (logDB *LoggerDB) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerDB) Status 

func (logDB *LoggerDB) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to the configured DB

func (*LoggerDB) StatusLogs 

func (logDB *LoggerDB) StatusLogs(uuid, environment string, seconds int64) ([]OsqueryStatusData, error)

StatusLogs will retrieve all status logs

func (*LoggerDB) StatusLogsLimit 

func (logDB *LoggerDB) StatusLogsLimit(uuid, environment string, limit int) ([]OsqueryStatusData, error)

StatusLogsLimit will retrieve a limited number of status logs

type LoggerElastic 

type LoggerElastic struct {
	Configuration config.ElasticLogger
	Enabled       bool
	Client        *elasticsearch.Client
}

LoggerElastic will be used to log data using Elastic

func CreateLoggerElastic 

func CreateLoggerElastic(cfg *config.ElasticLogger) (*LoggerElastic, error)

CreateLoggerElastic to initialize the logger

func (*LoggerElastic) IndexName 

func (logE *LoggerElastic) IndexName() string

IndexName - Function to return the index name

func (*LoggerElastic) Send 

func (logE *LoggerElastic) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Elastic

func (*LoggerElastic) Settings 

func (logE *LoggerElastic) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerFile 

type LoggerFile struct {
	Enabled  bool
	Filename string
	Logger   *zerolog.Logger
}

LoggerFile will be used to log data using external file

func CreateLoggerFile 

func CreateLoggerFile(cfg *config.LocalLogger) (*LoggerFile, error)

CreateLoggerFile to initialize the logger

func (*LoggerFile) Log 

func (logFile *LoggerFile) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to stdout

func (*LoggerFile) Query 

func (logFile *LoggerFile) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to stdout

func (*LoggerFile) Result 

func (logFile *LoggerFile) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to stdout

func (*LoggerFile) Settings 

func (logFile *LoggerFile) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerFile) Status 

func (logFile *LoggerFile) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to stdout

type LoggerGraylog 

type LoggerGraylog struct {
	Configuration config.GraylogLogger
	Headers       map[string]string
	Enabled       bool
}

LoggerGraylog will be used to log data using Graylog

func CreateLoggerGraylog 

func CreateLoggerGraylog(cfg *config.GraylogLogger) (*LoggerGraylog, error)

CreateLoggerGraylog to initialize the logger

func (*LoggerGraylog) Send 

func (logGL *LoggerGraylog) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Graylog

func (*LoggerGraylog) Settings 

func (logGL *LoggerGraylog) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerKafka 

type LoggerKafka struct {
	Enabled bool
	// contains filtered or unexported fields
}

func CreateLoggerKafka 

func CreateLoggerKafka(config *config.KafkaLogger) (*LoggerKafka, error)

func (*LoggerKafka) Send 

func (l *LoggerKafka) Send(logType string, data []byte, environment, uuid string, debug bool)

func (*LoggerKafka) Settings 

func (l *LoggerKafka) Settings(mgr *settings.Settings)

type LoggerKinesis 

type LoggerKinesis struct {
	Configuration config.KinesisLogger
	KinesisClient *kinesis.Client
	Enabled       bool
}

LoggerKinesis will be used to log data using Kinesis

func CreateLoggerKinesis 

func CreateLoggerKinesis(cfg *config.KinesisLogger) (*LoggerKinesis, error)

CreateLoggerKinesis to initialize the logger

func (*LoggerKinesis) Send 

func (logSK *LoggerKinesis) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Splunk HTTP Event Collector

func (*LoggerKinesis) Settings 

func (logSK *LoggerKinesis) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerLogstash 

type LoggerLogstash struct {
	Configuration config.LogstashLogger
	Headers       map[string]string
	Enabled       bool
}

LoggerLogstash will be used to log data using Logstash

func CreateLoggerLogstash 

func CreateLoggerLogstash(cfg *config.LogstashLogger) (*LoggerLogstash, error)

CreateLoggerLogstash to initialize the logger

func (*LoggerLogstash) SendHTTP 

func (logLS *LoggerLogstash) SendHTTP(logType string, data []byte, environment, uuid string, debug bool)

SendHTTP - Function that sends JSON logs to Logstash via HTTP

func (*LoggerLogstash) SendTCP 

func (logLS *LoggerLogstash) SendTCP(logType string, data []byte, environment, uuid string, debug bool)

SendTCP - Function that sends data to Logstash via TCP

func (*LoggerLogstash) SendUDP 

func (logLS *LoggerLogstash) SendUDP(logType string, data []byte, environment, uuid string, debug bool)

SendUDP - Function that sends data to Logstash via UDP

func (*LoggerLogstash) Settings 

func (logLS *LoggerLogstash) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerNone 

type LoggerNone struct {
	Enabled bool
}

LoggerNone will be used to not log any data

func CreateLoggerNone 

func CreateLoggerNone() (*LoggerNone, error)

CreateLoggerNone to initialize the logger

func (*LoggerNone) Log 

func (logNone *LoggerNone) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to stdout

func (*LoggerNone) Query 

func (logNone *LoggerNone) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to stdout

func (*LoggerNone) Result 

func (logNone *LoggerNone) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to stdout

func (*LoggerNone) Settings 

func (logNone *LoggerNone) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerNone) Status 

func (logNone *LoggerNone) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to stdout

type LoggerS3 

type LoggerS3 struct {
	S3Config  osctrl_config.S3Logger
	AWSConfig aws.Config
	Client    *s3.Client
	Enabled   bool
	Debug     bool
}

LoggerS3 will be used to log data using S3

func CreateLoggerS3 

func CreateLoggerS3(s3Config *osctrl_config.S3Logger) (*LoggerS3, error)

CreateLoggerS3 to initialize the logger

func (*LoggerS3) Send 

func (logS3 *LoggerS3) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to S3

func (*LoggerS3) Settings 

func (logS3 *LoggerS3) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerSplunk 

type LoggerSplunk struct {
	Configuration config.SplunkLogger
	Headers       map[string]string
	Enabled       bool
}

LoggerSplunk will be used to log data using Splunk

func CreateLoggerSplunk 

func CreateLoggerSplunk(cfg *config.SplunkLogger) (*LoggerSplunk, error)

CreateLoggerSplunk to initialize the logger

func (*LoggerSplunk) Send 

func (logSP *LoggerSplunk) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Splunk HTTP Event Collector

func (*LoggerSplunk) Settings 

func (logSP *LoggerSplunk) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerStdout 

type LoggerStdout struct {
	Enabled bool
}

LoggerStdout will be used to log data using stdout

func CreateLoggerStdout 

func CreateLoggerStdout() (*LoggerStdout, error)

CreateLoggerStdout to initialize the logger

func (*LoggerStdout) Log 

func (logStdout *LoggerStdout) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to stdout

func (*LoggerStdout) Query 

func (logStdout *LoggerStdout) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to stdout

func (*LoggerStdout) Result 

func (logStdout *LoggerStdout) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to stdout

func (*LoggerStdout) Settings 

func (logStdout *LoggerStdout) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerStdout) Status 

func (logStdout *LoggerStdout) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to stdout

type LoggerTLS 

type LoggerTLS struct {
	Logging      string
	Logger       interface{}
	AlwaysLogger *LoggerDB
	Nodes        *nodes.NodeManager
	Queries      *queries.Queries
}

LoggerTLS will be used to handle logging for the TLS endpoint

func CreateLoggerTLS 

func CreateLoggerTLS(cfg config.ServiceParameters, mgr *settings.Settings, nodes *nodes.NodeManager, queries *queries.Queries) (*LoggerTLS, error)

CreateLoggerTLS to instantiate a new logger for the TLS endpoint

func (*LoggerTLS) DispatchLogs 

func (l *LoggerTLS) DispatchLogs(data []byte, uuid, logType, environment string, metadata nodes.NodeMetadata, debug bool)

DispatchLogs - Helper to dispatch logs

func (*LoggerTLS) DispatchQueries 

func (l *LoggerTLS) DispatchQueries(queryData types.QueryWriteData, node nodes.OsqueryNode, debug bool)

DispatchQueries - Helper to dispatch queries

func (*LoggerTLS) Log 

func (logTLS *LoggerTLS) Log(logType string, data []byte, environment, uuid string, debug bool)

Log will send status/result logs via the configured method of logging

func (*LoggerTLS) ProcessLogQueryResult 

func (l *LoggerTLS) ProcessLogQueryResult(queriesWrite types.QueryWriteRequest, envid uint, debug bool)

ProcessLogQueryResult - Helper to process on-demand query result logs

func (*LoggerTLS) ProcessLogs 

func (l *LoggerTLS) ProcessLogs(data json.RawMessage, logType, environment, ipaddress string, dataLen int, debug bool)

ProcessLogs - Helper to process logs

func (*LoggerTLS) QueryLog 

func (logTLS *LoggerTLS) QueryLog(logType string, data []byte, environment, uuid, name string, status int, debug bool)

QueryLog will send query result logs via the configured method of logging

type LogstashMessage 

type LogstashMessage struct {
	Time        int64       `json:"time"`
	LogType     string      `json:"log_type"`
	UUID        string      `json:"uuid"`
	Environment string      `json:"environment"`
	Data        interface{} `json:"data"`
}

LogstashMessage to handle log format to be sent to Logstash

type OsqueryQueryData 

type OsqueryQueryData struct {
	gorm.Model
	UUID        string `gorm:"index"`
	Environment string
	Name        string
	Data        string
	Status      int
}

OsqueryQueryData to log query data to database

type OsqueryResultData 

type OsqueryResultData struct {
	gorm.Model
	UUID        string `gorm:"index"`
	Environment string
	Name        string
	Action      string
	Epoch       int64
	Columns     string
	Counter     int
}

OsqueryResultData to log result data to database

type OsqueryStatusData 

type OsqueryStatusData struct {
	gorm.Model
	UUID        string `gorm:"index"`
	Environment string
	Line        string
	Message     string
	Version     string
	Filename    string
	Severity    string
}

OsqueryStatusData to log status data to database

type SplunkMessage 

type SplunkMessage struct {
	Time       int64       `json:"time"`
	Host       string      `json:"host"`
	Source     string      `json:"source"`
	SourceType string      `json:"sourcetype"`
	Index      string      `json:"index"`
	Event      interface{} `json:"event"`
}

SplunkMessage to handle log format to be sent to Splunk

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.