darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make audit data buffer size unconfigurable

Browse Source
This commit is contained in:
Aleksei Nikiforov 2020-01-27 12:25:48 +03:00
parent 3479a02ac2
commit d8bde76fd2
2 changed files with 3 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
auditd-clickhouse.conf
View File

@ -1,5 +1,4 @@
[General]
#BufferSize=4096
DatatypesDescriptionFile=/etc/audisp/auditd-clickhouse-datatypes.json
# Timeout is in seconds
# Zero or negative value disables this feature

9
auditd-plugin-clickhouse.cpp
View File

@ -650,7 +650,6 @@ int main(int argc, char **argv)
clickhouse::ClientOptions client_options;
std::string table_name = "AuditData";
size_t buffer_size = 4096;
std::string datatypes_filename;
std::string data_directory;
@ -720,7 +719,6 @@ int main(int argc, char **argv)
auto general = clickhouse_config_tree.get_child_optional("General");
if (general)
{
optional_set(buffer_size, *general, "BufferSize");
optional_set(datatypes_filename, *general, "DatatypesDescriptionFile");
optional_set(write_timeout, *general, "WriteTimeout");
optional_set(write_count_limit, *general, "WriteCountLimit");
@ -988,8 +986,7 @@ int main(int argc, char **argv)
auparse_add_callback(au.get(), auparse_callback, &callback_data, NULL);
std::vector<char> data;
data.resize(buffer_size);
char data[MAX_AUDIT_MESSAGE_LENGTH];
struct pollfd pollfds[2];
@ -1019,10 +1016,10 @@ int main(int argc, char **argv)
}
else if (pollfds[0].revents & POLLIN)
{
ssize_t readsize = read(STDIN_FILENO, data.data(), data.size());
ssize_t readsize = read(STDIN_FILENO, data, sizeof(data));
if (readsize > 0)
{
auparse_feed(au.get(), data.data(), readsize);
auparse_feed(au.get(), data, readsize);
}
else
{