darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Commit Graph

  • 9d449b911f dummy change tmp Aleksei Nikiforov 2020-06-25 15:53:23 +03:00
  • ade304c040 20200207.3-alt1 sisyphus Aleksei Nikiforov 2020-02-07 17:59:19 +03:00
  • 390dd83733 Log and ignore exceptions on failure to write data to disk for temporary storage Aleksei Nikiforov 2020-02-07 17:54:59 +03:00
  • 7f28de5a99 20200130.3-alt1 Aleksei Nikiforov 2020-01-29 16:56:35 +03:00
  • 7207939afe Add new field "port" to known database fields Aleksei Nikiforov 2020-01-30 11:42:55 +03:00
  • 8c31581728 Improved logging Aleksei Nikiforov 2020-01-30 11:41:54 +03:00
  • 6fecac06f8 Don't fill empty record fields preemptively Aleksei Nikiforov 2020-01-29 16:36:56 +03:00
  • 17d6a6489c Don't store record names in the record itself Aleksei Nikiforov 2020-01-29 14:47:27 +03:00
  • 69df9988ad 20200127-alt1 Aleksei Nikiforov 2020-01-27 13:13:26 +03:00
  • 893f013d27 Use std::make_shared for AbstractRecordField descendands creation Aleksei Nikiforov 2020-01-28 17:29:57 +03:00
  • 237f504efe Only send signal for data writing when reaching specified amount of data Aleksei Nikiforov 2020-01-27 18:11:20 +03:00
  • 3f295f3e05 auparse: flush feed and release memory Aleksei Nikiforov 2020-01-27 17:06:42 +03:00
  • d8bde76fd2 Make audit data buffer size unconfigurable Aleksei Nikiforov 2020-01-27 12:25:48 +03:00
  • 3479a02ac2 Reduce objects copying Aleksei Nikiforov 2020-01-27 11:56:43 +03:00
  • 5dfb70a328 Don't stop writer thread before all data is processed Aleksei Nikiforov 2020-01-23 18:20:49 +03:00
  • 972da5776a Fix memory leak from auparse_get_node Aleksei Nikiforov 2020-01-23 17:40:54 +03:00
  • 62adea5afd Send data to database only in chunks exceeding limit count if one is specified Aleksei Nikiforov 2020-01-23 16:08:53 +03:00
  • f0fe0f5a61 Don't store logs internally if logging to file is disabled Aleksei Nikiforov 2020-01-23 15:22:58 +03:00
  • 1520830a97 Don't pollute log while emptying data pipe and no data is present Aleksei Nikiforov 2020-01-23 15:09:32 +03:00
  • 7ae97f57d7 20200116-alt1 Aleksei Nikiforov 2020-01-16 12:34:03 +03:00
  • 1dc7f65269 Add new fields to known database fields Aleksei Nikiforov 2020-01-16 15:10:03 +03:00
  • 6fc2fe5320 Add serialization test Aleksei Nikiforov 2020-01-16 11:45:25 +03:00
  • bb98d8809a Get rid of some dynamic_pointer_casts by updating return types Aleksei Nikiforov 2020-01-15 18:41:53 +03:00
  • 7a04b13645 Add information about date and time into log Aleksei Nikiforov 2020-01-15 16:17:46 +03:00
  • ddcdfa9c1c Improve logging messages for POLLHUP and POLLERR conditions Aleksei Nikiforov 2020-01-14 15:25:27 +03:00
  • 6677b661c2 Save audit record filename into audit record class Aleksei Nikiforov 2020-01-15 15:26:53 +03:00
  • e54ea41414 Read previously saved data when application is launched Aleksei Nikiforov 2020-01-15 14:41:46 +03:00
  • aaf2d3b886 Implement audit data removal Aleksei Nikiforov 2020-01-15 11:28:10 +03:00
  • e9cb80077d Implement audit record deserialization Aleksei Nikiforov 2020-01-14 17:53:22 +03:00
  • a42ec11de1 Serialize and save data before sending it to write thread Aleksei Nikiforov 2020-01-14 17:16:01 +03:00
  • be7e252971 Record all unknown fields into special "unknown_field" array Aleksei Nikiforov 2020-01-14 15:10:11 +03:00
  • b1287924f2 Make logging compatible with logrotate tool and provide logrotate config Aleksei Nikiforov 2020-01-14 13:06:22 +03:00
  • 149a7e7a44 Move some functions to utils file Aleksei Nikiforov 2020-01-14 11:55:05 +03:00
  • 8e2910ab94 Add bufferization of data and separate writer thread Aleksei Nikiforov 2020-01-13 12:52:33 +03:00
  • 36891f1273 Move audit data convertion into separate functions Aleksei Nikiforov 2020-01-14 11:13:38 +03:00
  • 1895289a87 Add buffered logging and new option for logfile location Aleksei Nikiforov 2020-01-10 14:59:03 +03:00
  • 0ea79509b8 Add conversion from field type to string and use it to improve logging Aleksei Nikiforov 2020-01-10 14:15:59 +03:00
  • 559944866f Fix AUPARSE_TYPE_ARCH and AUPARSE_TYPE_CAP_BITMAP checks Aleksei Nikiforov 2020-01-13 14:35:07 +03:00
  • c99829625f Unclassified field type can be either string or integer Aleksei Nikiforov 2020-01-10 12:03:29 +03:00
  • 517d5d87c4 Properly process NULL strings Aleksei Nikiforov 2020-01-10 11:49:59 +03:00
  • ba27894d20 20191217-alt1 Aleksei Nikiforov 2019-12-17 15:11:43 +03:00
  • c811c95797 Fix column names after tables flattening Aleksei Nikiforov 2019-12-17 14:40:39 +03:00
  • a0ea1c1f26 Revert "Process nested structures as arrays" Aleksei Nikiforov 2019-12-17 14:39:06 +03:00
  • 0e852e9ad3 Don't use Nested clickhouse type, flatten tables. Aleksei Nikiforov 2019-12-17 14:24:32 +03:00
  • 853818b7ab Also exit if some error with stdin is encountered Aleksei Nikiforov 2019-12-17 14:24:28 +03:00
  • f2c0a405dd Process nested structures as arrays Aleksei Nikiforov 2019-12-17 12:42:51 +03:00
  • 9906c2e5a4 Sanitize column names Aleksei Nikiforov 2019-12-16 18:21:13 +03:00
  • 10b9a9c159 Enable reconnect to clickhouse server by default Aleksei Nikiforov 2019-12-17 12:25:33 +03:00
  • 9d5a803603 Fix column types Aleksei Nikiforov 2019-12-16 17:00:48 +03:00
  • c6b1330fb5 Write all data into database Aleksei Nikiforov 2019-12-16 16:09:45 +03:00
  • ef3b71bf27 Catch and process exceptions in audit callback Aleksei Nikiforov 2019-12-16 15:43:29 +03:00
  • 575ca79ff1 Populate empty fields Aleksei Nikiforov 2019-12-16 15:35:40 +03:00
  • 7ed7d49a25 Add function for columns generation from record field class Aleksei Nikiforov 2019-12-12 17:53:14 +03:00
  • 508ca46a67 Update string_array type to use nested arrays instead of single array Aleksei Nikiforov 2019-12-12 17:01:12 +03:00
  • 98bc48492f audit record: create and reuse fields Aleksei Nikiforov 2019-12-12 16:12:44 +03:00
  • 0aca43be6f Rework code for type match checking Aleksei Nikiforov 2019-12-12 15:01:59 +03:00
  • 4de04f70b9 Improve audit callback: start creating audit record to be added to DB later Aleksei Nikiforov 2019-12-12 15:01:19 +03:00
  • 3c09000edc Implement string_array type Aleksei Nikiforov 2019-12-11 17:16:28 +03:00
  • 3ba3561664 Implement warnings and mark all optional fields as Nullable Aleksei Nikiforov 2019-12-11 16:35:42 +03:00
  • ef888ec74b Update json datatypes structure to match one expected by application Aleksei Nikiforov 2019-12-11 16:24:00 +03:00
  • d7ac138531 Implement clickhouse database creation Aleksei Nikiforov 2019-12-11 16:06:13 +03:00
  • fef1385176 Add datatypes file parsing function Aleksei Nikiforov 2019-12-11 14:50:32 +03:00
  • 2875907d35 Add file with audit types mapping Aleksei Nikiforov 2019-12-09 15:58:48 +03:00
  • 826ae34d18 Modify integer record field to also store interpreted string value Aleksei Nikiforov 2019-12-09 12:19:58 +03:00
  • cfd18dd0d9 Initial processing of audit types added Aleksei Nikiforov 2019-12-09 11:44:51 +03:00
  • 7f1ed9da8f Add clickhouse config parsing and initial audit setup Aleksei Nikiforov 2019-11-12 12:54:16 +03:00
  • 35d96682eb Initial commit Aleksei Nikiforov 2019-11-11 16:55:42 +03:00