Help us shape the future of Go! Take the 2026 Go Developer Survey

logging

package
v0.5.6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 19, 2026 License: MIT Imports: 37 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// GraylogVersion - GELF spec version
	GraylogVersion = "1.1"
	// GraylogLevel - Log Level (informational)
	GraylogLevel = 6
	// GraylogMethod - Method to send
	GraylogMethod = "POST"
)
View Source 
const (
	// LogstashTCP for TCP inputs
	LogstashTCP = "tcp"
	// LogstashUDP for UDP inputs
	LogstashUDP = "udp"
	// LogstashHTTP for HTTP inputs
	LogstashHTTP = "http"
)
View Source 
const (
	// LogstashMethod Method to send requests
	LogstashMethod = "POST"
	// LogstashContentType Content Type for requests
	LogstashContentType = "application/json"
)
View Source 
const (
	// SplunkMethod Method to send requests
	SplunkMethod = "POST"
	// SplunkContentType Content Type for requests
	SplunkContentType = "application/json"
)
View Source 
const (
	// NotReturned - Value not returned from agent
	NotReturned = "not returned"
	// Mismatched - Value mismatched in log entries
	Mismatched = "mismatched"
)
View Source 
const (
	// Default time format for loggers
	LoggerTimeFormat string = "2006-01-02T15:04:05.999Z07:00"
)

Variables

This section is empty.

Functions

func CreateDebugHTTP added in v0.4.5 

func CreateDebugHTTP(cfg config.LocalLogger) (*zerolog.Logger, error)

CreateDebugHTTP to initialize the debug HTTP logger

func GetNodeLogs added in v0.5.2 

func GetNodeLogs(db *gorm.DB, logType, env, uuid string, since time.Time, limit int, search string) ([]map[string]any, error)

GetNodeLogs retrieves recent log entries for a single node (status or result). logType must be "status" or "result". Results are ordered by created_at DESC. If since is non-zero only entries created strictly after that time are returned. limit is clamped to [1, 1000].

search is an optional free-text filter (substring, case-insensitive). It runs as a `LIKE` against the human-readable text columns of the row:

  • status: line + message + filename
  • result: name + action + columns (the serialized JSON of matched fields)

Empty search disables the filter — same behavior as a missing param.

The `LIKE` is unindexed today. If the result_data / status_data tables grow large enough to make this slow, an operator-side workaround is to narrow `since` first, which keeps the matched row count small.

func GetNodeResultBucketed added in v0.5.2 

func GetNodeResultBucketed(db *gorm.DB, env, uuid string, since time.Time, bucketSeconds int) ([]dbutil.BucketedRow, error)

GetNodeResultBucketed mirrors GetNodeStatusBucketed for osquery_result_data.

func GetNodeResultTimestamps added in v0.5.2 

func GetNodeResultTimestamps(db *gorm.DB, env, uuid string, since time.Time) ([]time.Time, error)

func GetNodeStatusBucketed added in v0.5.2 

func GetNodeStatusBucketed(db *gorm.DB, env, uuid string, since time.Time, bucketSeconds int) ([]dbutil.BucketedRow, error)

GetNodeStatusBucketed returns per-bucket row counts for `uuid` in `env` since `since`, with buckets aligned to `bucketSeconds`. The SQL pushes the histogram into the database (one GROUP BY) instead of shipping every timestamp to the API process — orders of magnitude less wire traffic on chatty nodes.

func GetNodeStatusTimestamps added in v0.5.2 

func GetNodeStatusTimestamps(db *gorm.DB, env, uuid string, since time.Time) ([]time.Time, error)

GetNodeStatusTimestamps and GetNodeResultTimestamps return just the CreatedAt column for every status/result log row a given node has shipped since `since`. Used by the per-node activity heatmap so it can bucket on the API side without dragging the row bodies across the wire.

Returning a slice of timestamps (rather than int64 epochs) keeps the downstream bucketing arithmetic in Go's time domain, which is what the rest of cmd/api/handlers/stats.go uses.

func GetQueryResults added in v0.5.2 

func GetQueryResults(db *gorm.DB, name string, since time.Time, page, pageSize int) ([]map[string]any, int64, error)

GetQueryResults retrieves rows of query result data (one per node) for a single query name. Results are ordered by created_at ASC (oldest first — query results are append-only). If since is non-zero only rows created strictly after that time are returned. page is 1-indexed; pageSize is clamped to [1, 1000]; pageSize <= 0 defaults to 100. Returns the page items, total matching rows, and any error.

func LoadLogstash 

func LoadLogstash(file string) (config.LogstashLogger, error)

LoadLogstash - Function to load the Logstash configuration from JSON file

func StreamQueryResults added in v0.5.2 

func StreamQueryResults(db *gorm.DB, name string, fn func(OsqueryQueryData) error) error

StreamQueryResults invokes fn for each row of query result data for `name`, ordered by created_at ASC. Rows are read via a cursor so memory usage stays bounded — used by the CSV exporter. fn may return an error to stop iteration; that error is returned by StreamQueryResults.

Types

type DataExporter added in v0.5.6 

type DataExporter interface {
	Name() string
	IsEnabled() bool
	Export(logType string, data []byte, params ExportParams) error
}

DataExporter is a destination for osquery status, result, and query data.

func CreateExporter added in v0.5.6 

func CreateExporter(exporterType string, cfg config.ServiceParameters, mgr *settings.Settings) (DataExporter, bool, error)

CreateExporter builds one exporter implementation from its configured type. This is the only place that should switch on exporter type; request-time dispatch goes through the DataExporter interface.

type ExportParams added in v0.5.6 

type ExportParams struct {
	Environment string
	UUID        string
	QueryName   string
	Status      int
	Debug       bool
}

ExportParams contains the metadata shared by every osquery data exporter. QueryName and Status are set only for on-demand query result exports.

type GraylogMessage 

type GraylogMessage struct {
	Version      string `json:"version"`
	Host         string `json:"host"`
	ShortMessage string `json:"short_message"`
	Timestamp    int64  `json:"timestamp"`
	Level        uint   `json:"level"`
	Environment  string `json:"_environment"`
	Type         string `json:"_type"`
	UUID         string `json:"_uuid"`
}

GraylogMessage to handle log format to be sent to Graylog

type LogReader added in v0.5.6 

type LogReader interface {
	// NodeLogs returns recent log entries for a single node (status or
	// result), ordered by created_at DESC. since is exclusive; empty means
	// no lower bound. limit is clamped to [1,1000] by the caller. search
	// is an optional case-insensitive substring filter against the row's
	// human-readable columns (best-effort for S3).
	NodeLogs(logType, env, uuid string, since time.Time, limit int, search string) ([]map[string]any, error)

	// QueryResults returns rows of query result data (one per node) for a
	// single query name, ordered by created_at ASC. env is the environment
	// UUID/name used to scope the read (the DB reader ignores it; the S3
	// reader uses it as the key prefix). Pagination is 1-indexed; pageSize
	// clamped to [1,1000]. Returns the page items, the total matching
	// count, and any error.
	QueryResults(env, name string, since time.Time, page, pageSize int) ([]map[string]any, int64, error)

	// StreamQueryResults invokes fn for each row of query result data for
	// `name`, ordered by created_at ASC. env scopes the read (DB reader
	// ignores it; S3 reader uses it as the key prefix). Rows are streamed
	// so memory stays bounded — used by the CSV exporter and the
	// console/file-explorer result decoders. fn may return an error to
	// stop iteration.
	StreamQueryResults(env, name string, fn func(OsqueryQueryData) error) error
}

LogReader is the read-side abstraction over status / result / query logs.

The historical implementation reads the `osquery_status_data`, `osquery_result_data` and `osquery_query_data` tables from the GORM DB (see dbLogReader). When the TLS logger is configured to ship logs to S3, those tables are empty — the data lives in S3 objects instead — and s3LogReader (see s3_reader.go) is wired in so the API/console/file explorer can still surface logs to the frontend.

The interface intentionally mirrors the *read* functions the API and the console/file-explorer managers already use, so a handler does not care whether the backing store is the DB or S3.

func NewDBLogReader added in v0.5.6 

func NewDBLogReader(db *gorm.DB) LogReader

NewDBLogReader returns a LogReader backed by the given GORM DB.

func NewS3LogReader added in v0.5.6 

func NewS3LogReader(client *s3.Client, bucket string) LogReader

NewS3LogReader returns a LogReader backed by the given S3 client/bucket. The client is the same one LoggerS3 already constructs at TLS startup, so the reader shares the configured credentials/region.

type LoggerDB 

type LoggerDB struct {
	Database *backend.DBManager
	Enabled  bool
}

LoggerDB will be used to log data using a database

func CreateLoggerDB 

func CreateLoggerDB(backend *backend.DBManager) (*LoggerDB, error)

CreateLoggerDB to initialize the logger without reading a config file

func CreateLoggerDBConfig 

func CreateLoggerDBConfig(dbConfig *config.YAMLConfigurationDB) (*LoggerDB, error)

CreateLoggerDB to initialize the logger without reading a config file

func (*LoggerDB) CleanQueryLogs 

func (logDB *LoggerDB) CleanQueryLogs(entries int64) error

CleanQueryLogs will delete old query logs

func (*LoggerDB) CleanResultLogs 

func (logDB *LoggerDB) CleanResultLogs(environment string, seconds int64) error

CleanResultLogs will delete old status logs

func (*LoggerDB) CleanStatusLogs 

func (logDB *LoggerDB) CleanStatusLogs(environment string, seconds int64) error

CleanStatusLogs will delete old status logs

func (*LoggerDB) Export added in v0.5.6 

func (logDB *LoggerDB) Export(logType string, data []byte, params ExportParams) error

func (*LoggerDB) IsEnabled added in v0.5.6 

func (logDB *LoggerDB) IsEnabled() bool

func (*LoggerDB) Log 

func (logDB *LoggerDB) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to the configured DB

func (*LoggerDB) Name added in v0.5.6 

func (logDB *LoggerDB) Name() string

func (*LoggerDB) Query 

func (logDB *LoggerDB) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to the configured DB

func (*LoggerDB) QueryLogs 

func (logDB *LoggerDB) QueryLogs(name string) ([]OsqueryQueryData, error)

QueryLogs will retrieve all query logs

func (*LoggerDB) Result 

func (logDB *LoggerDB) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to the configured DB

func (*LoggerDB) ResultLogs 

func (logDB *LoggerDB) ResultLogs(uuid, environment string, seconds int64) ([]OsqueryResultData, error)

ResultLogs will retrieve all result logs

func (*LoggerDB) ResultLogsLimit 

func (logDB *LoggerDB) ResultLogsLimit(uuid, environment string, limit int) ([]OsqueryResultData, error)

ResultLogsLimit will retrieve a limited number of result logs

func (*LoggerDB) Settings 

func (logDB *LoggerDB) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerDB) Status 

func (logDB *LoggerDB) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to the configured DB

func (*LoggerDB) StatusLogs 

func (logDB *LoggerDB) StatusLogs(uuid, environment string, seconds int64) ([]OsqueryStatusData, error)

StatusLogs will retrieve all status logs

func (*LoggerDB) StatusLogsLimit 

func (logDB *LoggerDB) StatusLogsLimit(uuid, environment string, limit int) ([]OsqueryStatusData, error)

StatusLogsLimit will retrieve a limited number of status logs

type LoggerElastic 

type LoggerElastic struct {
	Configuration config.ElasticLogger
	Enabled       bool
	Client        *elasticsearch.Client
}

LoggerElastic will be used to log data using Elastic

func CreateLoggerElastic 

func CreateLoggerElastic(cfg *config.ElasticLogger) (*LoggerElastic, error)

CreateLoggerElastic to initialize the logger

func (*LoggerElastic) Export added in v0.5.6 

func (logE *LoggerElastic) Export(logType string, data []byte, params ExportParams) error

func (*LoggerElastic) IndexName 

func (logE *LoggerElastic) IndexName() string

IndexName - Function to return the index name

func (*LoggerElastic) IsEnabled added in v0.5.6 

func (logE *LoggerElastic) IsEnabled() bool

func (*LoggerElastic) Name added in v0.5.6 

func (logE *LoggerElastic) Name() string

func (*LoggerElastic) Send 

func (logE *LoggerElastic) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Elastic

func (*LoggerElastic) Settings 

func (logE *LoggerElastic) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerFile 

type LoggerFile struct {
	Enabled  bool
	Filename string
	Logger   *zerolog.Logger
}

LoggerFile will be used to log data using external file

func CreateLoggerFile 

func CreateLoggerFile(cfg *config.LocalLogger) (*LoggerFile, error)

CreateLoggerFile to initialize the logger

func (*LoggerFile) Export added in v0.5.6 

func (logFile *LoggerFile) Export(logType string, data []byte, params ExportParams) error

func (*LoggerFile) IsEnabled added in v0.5.6 

func (logFile *LoggerFile) IsEnabled() bool

func (*LoggerFile) Log 

func (logFile *LoggerFile) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to stdout

func (*LoggerFile) Name added in v0.5.6 

func (logFile *LoggerFile) Name() string

func (*LoggerFile) Query 

func (logFile *LoggerFile) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to stdout

func (*LoggerFile) Result 

func (logFile *LoggerFile) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to stdout

func (*LoggerFile) Settings 

func (logFile *LoggerFile) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerFile) Status 

func (logFile *LoggerFile) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to stdout

type LoggerGraylog 

type LoggerGraylog struct {
	Configuration config.GraylogLogger
	Headers       map[string]string
	Enabled       bool
}

LoggerGraylog will be used to log data using Graylog

func CreateLoggerGraylog 

func CreateLoggerGraylog(cfg *config.GraylogLogger) (*LoggerGraylog, error)

CreateLoggerGraylog to initialize the logger

func (*LoggerGraylog) Export added in v0.5.6 

func (logGL *LoggerGraylog) Export(logType string, data []byte, params ExportParams) error

func (*LoggerGraylog) IsEnabled added in v0.5.6 

func (logGL *LoggerGraylog) IsEnabled() bool

func (*LoggerGraylog) Name added in v0.5.6 

func (logGL *LoggerGraylog) Name() string

func (*LoggerGraylog) Send 

func (logGL *LoggerGraylog) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Graylog

func (*LoggerGraylog) Settings 

func (logGL *LoggerGraylog) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerKafka 

type LoggerKafka struct {
	Enabled bool
	// contains filtered or unexported fields
}

func CreateLoggerKafka 

func CreateLoggerKafka(config *config.KafkaLogger) (*LoggerKafka, error)

func (*LoggerKafka) Export added in v0.5.6 

func (l *LoggerKafka) Export(logType string, data []byte, params ExportParams) error

func (*LoggerKafka) IsEnabled added in v0.5.6 

func (l *LoggerKafka) IsEnabled() bool

func (*LoggerKafka) Name added in v0.5.6 

func (l *LoggerKafka) Name() string

func (*LoggerKafka) Send 

func (l *LoggerKafka) Send(logType string, data []byte, environment, uuid string, debug bool)

func (*LoggerKafka) Settings 

func (l *LoggerKafka) Settings(mgr *settings.Settings)

type LoggerKinesis 

type LoggerKinesis struct {
	Configuration config.KinesisLogger
	KinesisClient *kinesis.Client
	Enabled       bool
}

LoggerKinesis will be used to log data using Kinesis

func CreateLoggerKinesis 

func CreateLoggerKinesis(cfg *config.KinesisLogger) (*LoggerKinesis, error)

CreateLoggerKinesis to initialize the logger

func (*LoggerKinesis) Export added in v0.5.6 

func (logSK *LoggerKinesis) Export(logType string, data []byte, params ExportParams) error

func (*LoggerKinesis) IsEnabled added in v0.5.6 

func (logSK *LoggerKinesis) IsEnabled() bool

func (*LoggerKinesis) Name added in v0.5.6 

func (logSK *LoggerKinesis) Name() string

func (*LoggerKinesis) Send 

func (logSK *LoggerKinesis) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Splunk HTTP Event Collector

func (*LoggerKinesis) Settings 

func (logSK *LoggerKinesis) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerLogstash 

type LoggerLogstash struct {
	Configuration config.LogstashLogger
	Headers       map[string]string
	Enabled       bool
}

LoggerLogstash will be used to log data using Logstash

func CreateLoggerLogstash 

func CreateLoggerLogstash(cfg *config.LogstashLogger) (*LoggerLogstash, error)

CreateLoggerLogstash to initialize the logger

func (*LoggerLogstash) Export added in v0.5.6 

func (logLS *LoggerLogstash) Export(logType string, data []byte, params ExportParams) error

func (*LoggerLogstash) IsEnabled added in v0.5.6 

func (logLS *LoggerLogstash) IsEnabled() bool

func (*LoggerLogstash) Name added in v0.5.6 

func (logLS *LoggerLogstash) Name() string

func (*LoggerLogstash) Send added in v0.5.6 

func (logLS *LoggerLogstash) Send(logType string, data []byte, environment, uuid string, debug bool)

Send routes Logstash exports to the configured protocol.

func (*LoggerLogstash) SendHTTP 

func (logLS *LoggerLogstash) SendHTTP(logType string, data []byte, environment, uuid string, debug bool)

SendHTTP - Function that sends JSON logs to Logstash via HTTP

func (*LoggerLogstash) SendTCP 

func (logLS *LoggerLogstash) SendTCP(logType string, data []byte, environment, uuid string, debug bool)

SendTCP - Function that sends data to Logstash via TCP

func (*LoggerLogstash) SendUDP 

func (logLS *LoggerLogstash) SendUDP(logType string, data []byte, environment, uuid string, debug bool)

SendUDP - Function that sends data to Logstash via UDP

func (*LoggerLogstash) Settings 

func (logLS *LoggerLogstash) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerNone 

type LoggerNone struct {
	Enabled bool
}

LoggerNone will be used to not log any data

func CreateLoggerNone 

func CreateLoggerNone() (*LoggerNone, error)

CreateLoggerNone to initialize the logger

func (*LoggerNone) Export added in v0.5.6 

func (logNone *LoggerNone) Export(logType string, data []byte, params ExportParams) error

func (*LoggerNone) IsEnabled added in v0.5.6 

func (logNone *LoggerNone) IsEnabled() bool

func (*LoggerNone) Log 

func (logNone *LoggerNone) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to stdout

func (*LoggerNone) Name added in v0.5.6 

func (logNone *LoggerNone) Name() string

func (*LoggerNone) Query 

func (logNone *LoggerNone) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to stdout

func (*LoggerNone) Result 

func (logNone *LoggerNone) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to stdout

func (*LoggerNone) Settings 

func (logNone *LoggerNone) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerNone) Status 

func (logNone *LoggerNone) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to stdout

type LoggerS3 

type LoggerS3 struct {
	S3Config  osctrl_config.S3Logger
	AWSConfig aws.Config
	Client    *s3.Client
	Enabled   bool
	Debug     bool
}

LoggerS3 will be used to log data using S3

func CreateLoggerS3 

func CreateLoggerS3(s3Config *osctrl_config.S3Logger) (*LoggerS3, error)

CreateLoggerS3 to initialize the logger

func (*LoggerS3) Export added in v0.5.6 

func (logS3 *LoggerS3) Export(logType string, data []byte, params ExportParams) error

func (*LoggerS3) IsEnabled added in v0.5.6 

func (logS3 *LoggerS3) IsEnabled() bool

func (*LoggerS3) Name added in v0.5.6 

func (logS3 *LoggerS3) Name() string

func (*LoggerS3) Query added in v0.5.6 

func (logS3 *LoggerS3) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON on-demand query result logs to S3.

The S3 key embeds the query `name` as a path segment so the reader can list by query name with a prefix filter — without it, the reader would have to list every query object in the environment and decode each body to find the ones matching `name`, which is catastrophically slow on a busy bucket.

Key layout: {env}/query/{name}/{uuid}/{ts}.json

The body is the same QueryWriteData JSON the DB logger would have stored, so the reader can decode it back into OsqueryQueryData rows.

func (*LoggerS3) Send 

func (logS3 *LoggerS3) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to S3

func (*LoggerS3) Settings 

func (logS3 *LoggerS3) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerSplunk 

type LoggerSplunk struct {
	Configuration config.SplunkLogger
	Headers       map[string]string
	Enabled       bool
}

LoggerSplunk will be used to log data using Splunk

func CreateLoggerSplunk 

func CreateLoggerSplunk(cfg *config.SplunkLogger) (*LoggerSplunk, error)

CreateLoggerSplunk to initialize the logger

func (*LoggerSplunk) Export added in v0.5.6 

func (logSP *LoggerSplunk) Export(logType string, data []byte, params ExportParams) error

func (*LoggerSplunk) IsEnabled added in v0.5.6 

func (logSP *LoggerSplunk) IsEnabled() bool

func (*LoggerSplunk) Name added in v0.5.6 

func (logSP *LoggerSplunk) Name() string

func (*LoggerSplunk) Send 

func (logSP *LoggerSplunk) Send(logType string, data []byte, environment, uuid string, debug bool)

Send - Function that sends JSON logs to Splunk HTTP Event Collector

func (*LoggerSplunk) Settings 

func (logSP *LoggerSplunk) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

type LoggerStdout 

type LoggerStdout struct {
	Enabled bool
}

LoggerStdout will be used to log data using stdout

func CreateLoggerStdout 

func CreateLoggerStdout() (*LoggerStdout, error)

CreateLoggerStdout to initialize the logger

func (*LoggerStdout) Export added in v0.5.6 

func (logStdout *LoggerStdout) Export(logType string, data []byte, params ExportParams) error

func (*LoggerStdout) IsEnabled added in v0.5.6 

func (logStdout *LoggerStdout) IsEnabled() bool

func (*LoggerStdout) Log 

func (logStdout *LoggerStdout) Log(logType string, data []byte, environment, uuid string, debug bool)

Log - Function that sends JSON result/status/query logs to stdout

func (*LoggerStdout) Name added in v0.5.6 

func (logStdout *LoggerStdout) Name() string

func (*LoggerStdout) Query 

func (logStdout *LoggerStdout) Query(data []byte, environment, uuid, name string, status int, debug bool)

Query - Function that sends JSON query logs to stdout

func (*LoggerStdout) Result 

func (logStdout *LoggerStdout) Result(data []byte, environment, uuid string, debug bool)

Result - Function that sends JSON result logs to stdout

func (*LoggerStdout) Settings 

func (logStdout *LoggerStdout) Settings(mgr *settings.Settings)

Settings - Function to prepare settings for the logger

func (*LoggerStdout) Status 

func (logStdout *LoggerStdout) Status(data []byte, environment, uuid string, debug bool)

Status - Function that sends JSON status logs to stdout

type LoggerTLS 

type LoggerTLS struct {
	Logging   string
	Exporters DataExporter
	Nodes     *nodes.NodeManager
	Queries   *queries.Queries
}

LoggerTLS will be used to handle logging for the TLS endpoint

func CreateLoggerTLS 

func CreateLoggerTLS(cfg config.ServiceParameters, mgr *settings.Settings, nodes *nodes.NodeManager, queries *queries.Queries) (*LoggerTLS, error)

CreateLoggerTLS to instantiate a new logger for the TLS endpoint

func (*LoggerTLS) DispatchLogs 

func (l *LoggerTLS) DispatchLogs(data []byte, uuid, logType, environment string, metadata nodes.NodeMetadata, debug bool)

DispatchLogs - Helper to dispatch logs

func (*LoggerTLS) DispatchQueries 

func (l *LoggerTLS) DispatchQueries(queryData types.QueryWriteData, node nodes.OsqueryNode, debug bool)

DispatchQueries - Helper to dispatch queries

func (*LoggerTLS) Log 

func (logTLS *LoggerTLS) Log(logType string, data []byte, environment, uuid string, debug bool)

Log will send status/result logs via the configured method of logging

func (*LoggerTLS) ProcessLogQueryResult 

func (l *LoggerTLS) ProcessLogQueryResult(queriesWrite types.QueryWriteRequest, envid uint, debug bool)

ProcessLogQueryResult - Helper to process on-demand query result logs

func (*LoggerTLS) ProcessLogs 

func (l *LoggerTLS) ProcessLogs(data json.RawMessage, logType, environment, ipaddress string, dataLen int, debug bool) []types.LogResultData

ProcessLogs processes and dispatches logs. Result entries are returned so callers can reuse the decoded batch for secondary consumers such as posture.

func (*LoggerTLS) QueryLog 

func (logTLS *LoggerTLS) QueryLog(logType string, data []byte, environment, uuid, name string, status int, debug bool)

QueryLog will send query result logs via the configured method of logging

type LogstashMessage 

type LogstashMessage struct {
	Time        int64       `json:"time"`
	LogType     string      `json:"log_type"`
	UUID        string      `json:"uuid"`
	Environment string      `json:"environment"`
	Data        interface{} `json:"data"`
}

LogstashMessage to handle log format to be sent to Logstash

type MultiExporter added in v0.5.6 

type MultiExporter struct {
	// contains filtered or unexported fields
}

MultiExporter fans out one osquery payload to multiple destinations. A failing exporter is logged and returned, but does not prevent later exporters from receiving the same payload.

func CreateExporters added in v0.5.6 

func CreateExporters(cfg config.ServiceParameters, mgr *settings.Settings) (*MultiExporter, error)

CreateExporters builds the composite exporter used by osctrl-tls.

func NewMultiExporter added in v0.5.6 

func NewMultiExporter(exporters ...DataExporter) *MultiExporter

NewMultiExporter creates a composite exporter from the provided destinations.

func (*MultiExporter) Export added in v0.5.6 

func (m *MultiExporter) Export(logType string, data []byte, params ExportParams) error

Export sends data to every enabled destination.

func (*MultiExporter) ExporterNames added in v0.5.6 

func (m *MultiExporter) ExporterNames() []string

ExporterNames returns the configured destination names in order.

func (*MultiExporter) IsEnabled added in v0.5.6 

func (m *MultiExporter) IsEnabled() bool

IsEnabled returns true when at least one contained exporter is enabled.

func (*MultiExporter) Name added in v0.5.6 

func (m *MultiExporter) Name() string

Name returns a comma-separated list of destination names for diagnostics.

type OsqueryQueryData 

type OsqueryQueryData struct {
	gorm.Model
	UUID        string `gorm:"index"`
	Environment string
	Name        string
	Data        string
	Status      int
}

OsqueryQueryData to log query data to database

type OsqueryResultData 

type OsqueryResultData struct {
	gorm.Model
	UUID        string `gorm:"index"`
	Environment string
	Name        string
	Action      string
	Epoch       int64
	Columns     string
	Counter     int
}

OsqueryResultData to log result data to database

type OsqueryStatusData 

type OsqueryStatusData struct {
	gorm.Model
	UUID        string `gorm:"index"`
	Environment string
	Line        string
	Message     string
	Version     string
	Filename    string
	Severity    string
}

OsqueryStatusData to log status data to database

type SplunkMessage 

type SplunkMessage struct {
	Time       int64       `json:"time"`
	Host       string      `json:"host"`
	Source     string      `json:"source"`
	SourceType string      `json:"sourcetype"`
	Index      string      `json:"index"`
	Event      interface{} `json:"event"`
}

SplunkMessage to handle log format to be sent to Splunk

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.