darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Save audit record filename into audit record class

Browse Source 
This will allow to remove files even if file naming scheme is changed
This commit is contained in:
Aleksei Nikiforov 2020-01-15 15:26:53 +03:00
parent e54ea41414
commit 6677b661c2
2 changed files with 16 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
auditd-plugin-clickhouse.cpp
View File

@ -34,6 +34,7 @@
#include <thread>
#include <mutex>
#include <chrono>
#include <utility>
#include <auparse.h>
#include <libaudit.h>
@ -364,13 +365,11 @@ void auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type, voi
}
}
std::string data_filename;
if (not callback_data->data_directory.empty())
{
data_filename = callback_data->data_directory + boost::filesystem::path::separator + generate_name_for_audit_record(audit_record);
audit_record.filename = callback_data->data_directory + boost::filesystem::path::separator + generate_name_for_audit_record(audit_record);
boost::property_tree::write_json(data_filename, audit_record.toPtree());
boost::property_tree::write_json(audit_record.filename, audit_record.toPtree());
}
if (callback_data->clickhouse_client && (!callback_data->table_name.empty()))
@ -386,9 +385,9 @@ void auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type, voi
callback_data->clickhouse_client->Insert(callback_data->table_name, block);
// Data written, remove it
if (not data_filename.empty())
if (not audit_record.filename.empty())
{
boost::filesystem::remove(data_filename);
boost::filesystem::remove(audit_record.filename);
}
}
else
@ -540,19 +539,17 @@ void writer_thread_function(clickhouse::Client &client, const std::string &table
{
for (auto iter = local_audit_records_list.rbegin(); iter != local_audit_records_list.rend(); ++iter)
{
std::string data_filename = data_directory + boost::filesystem::path::separator + generate_name_for_audit_record(*iter);
try
{
boost::filesystem::remove(data_filename);
boost::filesystem::remove(iter->filename);
}
catch (const std::exception &e)
{
Logger::write("Writer thread: caught exception while trying to remove data file \"%s\": %s\n", data_filename.c_str(), e.what());
Logger::write("Writer thread: caught exception while trying to remove data file \"%s\": %s\n", iter->filename.c_str(), e.what());
}
catch (...)
{
Logger::write("Writer thread: caught unknown exception while trying to remove data file \"%s\"\n", data_filename.c_str());
Logger::write("Writer thread: caught unknown exception while trying to remove data file \"%s\"\n", iter->filename.c_str());
}
}
}
@ -852,7 +849,9 @@ int main(int argc, char **argv)
boost::property_tree::ptree file_data;
boost::property_tree::read_json(iter->path().native(), file_data);
audit_records_set.insert(AuditRecord::fromPtree(file_data));
auto audit_record = AuditRecord::fromPtree(file_data);
audit_record.filename = iter->path().native();
audit_records_set.insert(std::move(audit_record));
}
catch (const std::exception &exc)
{
@ -907,19 +906,17 @@ int main(int argc, char **argv)
for (auto iter = audit_records_set.begin(); iter != audit_records_set.end(); ++iter)
{
std::string data_filename = data_directory + boost::filesystem::path::separator + generate_name_for_audit_record(*iter);
try
{
boost::filesystem::remove(data_filename);
boost::filesystem::remove(iter->filename);
}
catch (const std::exception &e)
{
Logger::write("Caught exception while trying to remove data file \"%s\": %s\n", data_filename.c_str(), e.what());
Logger::write("Caught exception while trying to remove data file \"%s\": %s\n", iter->filename.c_str(), e.what());
}
catch (...)
{
Logger::write("Caught unknown exception while trying to remove data file \"%s\"\n", data_filename.c_str());
Logger::write("Caught unknown exception while trying to remove data file \"%s\"\n", iter->filename.c_str());
}
}
}

2
auditd-record.hpp
View File

@ -92,6 +92,8 @@ struct AuditRecord
std::map<std::string, std::shared_ptr<AbstractRecordField> > fields;
std::string filename; // filename of file where data is stored; empty if no such file exists
boost::property_tree::ptree toPtree() const;
static AuditRecord fromPtree(const boost::property_tree::ptree &data);