mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
Files
analysis-22NN39
librenms-librenms/includes/polling/applications/suricata.inc.php
Zane C. Bowers-Hadley 0bbcde1227 add the ability for storing app data to prevent spamming of the event log via via component usage (#14087) 
* initial work on add the ability to save/fetch app data

* update to use get_app_data for ZFS

* update the poller for the new app_data stuff

* ZFS now logs changes to pools

* add schema update for app_data stuff

* small formatting fix

* add a missing \

* now adds a column

* sql-schema is no longer used, so remove the file that was added here

* misc cleanups

* rename the method in database/migrations/2022_07_03_1947_add_app_data.php

* hopefully fix the migration bit

* add the column to misc/db_schema.yaml

* more misc small DB fixes

* update the test as the json column uses collat of utf8mb4_bin

* revert the last change and try manually setting it to what is expected

* remove a extra ;

* update suricata as well

* correct the instance -> instances in one location to prevent the old instance list from being stomped

* remove a extra ;

* update fail2ban to use it as well

* remove two unused functions as suricata and fail2ban no longer use components

* style cleanup

* postgres poller updated to use it

* update html side of the postgres bits

* chronyd now uses app data bits now as well

* portactivity now uses it as well

* style fix

* sort the returned arrays from app_data

* correct log message for port activity

* collocation change

* try re-ordering it

* add in the new data column to the tests

* remove a extra ,

* hmm... ->collate('utf8mb4_unicode_ci') is not usable as apparently collate does not exist

* change the column type from json to longtext

* mv chronyd stuff while I sort out the rest of the tests... damn thing is always buggy

* hmm... fix a missing line then likely move stuff back

* style fix

* add fillable

* add the expexcted data for fail2ban json

* escape a " I missed

* add data for portactivity

* add suricata app data

* add app data to zfs legacy test

* put the moved tests back into place and update zfs-v1 test

* add app data for chronyd test

* add app data for fail2ban legacy test

* update zfs v1 app data

* add some notes on application dev work

* add Developing/Application-Notes.md to mkdocs.yml

* add data column to it

* added various suggestions from bennet-esyoil

* convert from isset to sizeof

* type fix

* fully remove the old save app data function and move it into a helper function... the other still needs cleaned up prior to removal

* update docs

* get_app_data is fully removed now as well

* a few style fixes

* add $casts

* update chronyd test

* attempt to fix the data

* more doc cleanup and try changing the cast

* style fix

* revert the changes to the chronyd test

* apply a few of murrant's suggestions

* document working with ->data as json and non-josn

* remove two no-longer used in this PR exceptions

* ->data now operates transparently

* style fix

* update data tests

* fix json

* test fix

* update the app notes to reflect how app data now works

* app test fix

* app data fix for linux_lsi

* json fix

* minor doc cleanup

* remove duplicate querty and use json_decode instead

* style fix

* modelize the app poller

* use a anon func instead of foreach

* test update

* style cleanup

* style cleanup

* another test cleanup

* more test cleanup

* reverse the test changes and add in some more glue code

* revert one of the test changes

* another small test fix

* Make things use models
Left some array access, but those will still work just fine.

* missed chronyd and portactivity

* rename poll to avoid make it any confusion

* Remove extra save and fix timestamp

* save any changes made to app->data

* nope, that was not it

* What are magic methods and how do they work?

* fix two typos

* update linux_lsi test

* change quote type

Co-authored-by: Tony Murray <murraytony@gmail.com>
2022-07-22 16:01:55 -05:00

192 lines
8.9 KiB
PHP
Raw Permalink Blame History

<?php
use LibreNMS\Exceptions\JsonAppException;
use LibreNMS\RRD\RrdDefinition;
$name = 'suricata';
try {
$suricata = json_app_get($device, 'suricata-stats');
} catch (JsonAppException $e) {
echo PHP_EOL . $name . ':' . $e->getCode() . ':' . $e->getMessage() . PHP_EOL;
update_application($app, $e->getCode() . ':' . $e->getMessage(), []); // Set empty metrics and error message
return;
}
// grab the alert here as it is the global one
$metrics = ['alert'=>$suricata['alert']];
$rrd_def = RrdDefinition::make()
->addDataset('af_dcerpc_tcp', 'DERIVE', 0)
->addDataset('af_dcerpc_udp', 'DERIVE', 0)
->addDataset('af_dhcp', 'DERIVE', 0)
->addDataset('af_dns_tcp', 'DERIVE', 0)
->addDataset('af_dns_udp', 'DERIVE', 0)
->addDataset('af_failed_tcp', 'DERIVE', 0)
->addDataset('af_failed_udp', 'DERIVE', 0)
->addDataset('af_ftp', 'DERIVE', 0)
->addDataset('af_ftp_data', 'DERIVE', 0)
->addDataset('af_http', 'DERIVE', 0)
->addDataset('af_ikev2', 'DERIVE', 0)
->addDataset('af_imap', 'DERIVE', 0)
->addDataset('af_krb5_tcp', 'DERIVE', 0)
->addDataset('af_krb5_udp', 'DERIVE', 0)
->addDataset('af_mqtt', 'DERIVE', 0)
->addDataset('af_nfs_tcp', 'DERIVE', 0)
->addDataset('af_nfs_udp', 'DERIVE', 0)
->addDataset('af_ntp', 'DERIVE', 0)
->addDataset('af_rdp', 'DERIVE', 0)
->addDataset('af_rfb', 'DERIVE', 0)
->addDataset('af_sip', 'DERIVE', 0)
->addDataset('af_smb', 'DERIVE', 0)
->addDataset('af_smtp', 'DERIVE', 0)
->addDataset('af_snmp', 'DERIVE', 0)
->addDataset('af_ssh', 'DERIVE', 0)
->addDataset('af_tftp', 'DERIVE', 0)
->addDataset('af_tls', 'DERIVE', 0)
->addDataset('alert', 'GAUGE', 0)
->addDataset('at_dcerpc_tcp', 'DERIVE', 0)
->addDataset('at_dcerpc_udp', 'DERIVE', 0)
->addDataset('at_dhcp', 'DERIVE', 0)
->addDataset('at_dns_tcp', 'DERIVE', 0)
->addDataset('at_dns_udp', 'DERIVE', 0)
->addDataset('at_ftp', 'DERIVE', 0)
->addDataset('at_ftp_data', 'DERIVE', 0)
->addDataset('at_http', 'DERIVE', 0)
->addDataset('at_ikev2', 'DERIVE', 0)
->addDataset('at_imap', 'DERIVE', 0)
->addDataset('at_krb5_tcp', 'DERIVE', 0)
->addDataset('at_krb5_udp', 'DERIVE', 0)
->addDataset('at_mqtt', 'DERIVE', 0)
->addDataset('at_nfs_tcp', 'DERIVE', 0)
->addDataset('at_nfs_udp', 'DERIVE', 0)
->addDataset('at_ntp', 'DERIVE', 0)
->addDataset('at_rdp', 'DERIVE', 0)
->addDataset('at_rfb', 'DERIVE', 0)
->addDataset('at_sip', 'DERIVE', 0)
->addDataset('at_smb', 'DERIVE', 0)
->addDataset('at_smtp', 'DERIVE', 0)
->addDataset('at_snmp', 'DERIVE', 0)
->addDataset('at_ssh', 'DERIVE', 0)
->addDataset('at_tftp', 'DERIVE', 0)
->addDataset('at_tls', 'DERIVE', 0)
->addDataset('bytes', 'DERIVE', 0)
->addDataset('dec_avg_pkt_size', 'DERIVE', 0)
->addDataset('dec_chdlc', 'DERIVE', 0)
->addDataset('dec_ethernet', 'DERIVE', 0)
->addDataset('dec_geneve', 'DERIVE', 0)
->addDataset('dec_ieee8021ah', 'DERIVE', 0)
->addDataset('dec_invalid', 'DERIVE', 0)
->addDataset('dec_ipv4', 'DERIVE', 0)
->addDataset('dec_ipv4_in_ipv6', 'DERIVE', 0)
->addDataset('dec_ipv6', 'DERIVE', 0)
->addDataset('dec_max_pkt_size', 'DERIVE', 0)
->addDataset('dec_mpls', 'DERIVE', 0)
->addDataset('dec_mx_mac_addrs_d', 'DERIVE', 0)
->addDataset('dec_mx_mac_addrs_s', 'DERIVE', 0)
->addDataset('dec_packets', 'DERIVE', 0)
->addDataset('dec_ppp', 'DERIVE', 0)
->addDataset('dec_pppoe', 'DERIVE', 0)
->addDataset('dec_raw', 'DERIVE', 0)
->addDataset('dec_sctp', 'DERIVE', 0)
->addDataset('dec_sll', 'DERIVE', 0)
->addDataset('dec_tcp', 'DERIVE', 0)
->addDataset('dec_teredo', 'DERIVE', 0)
->addDataset('dec_too_many_layer', 'DERIVE', 0)
->addDataset('dec_udp', 'DERIVE', 0)
->addDataset('dec_vlan', 'DERIVE', 0)
->addDataset('dec_vlan_qinq', 'DERIVE', 0)
->addDataset('dec_vntag', 'DERIVE', 0)
->addDataset('dec_vxlan', 'DERIVE', 0)
->addDataset('drop_percent', 'GAUGE', 0)
->addDataset('dropped', 'DERIVE', 0)
->addDataset('error_percent', 'GAUGE', 0)
->addDataset('errors', 'DERIVE', 0)
->addDataset('f_icmpv4', 'DERIVE', 0)
->addDataset('f_icmpv6', 'DERIVE', 0)
->addDataset('f_memuse', 'GAUGE', 0)
->addDataset('f_tcp', 'DERIVE', 0)
->addDataset('f_udp', 'DERIVE', 0)
->addDataset('ftp_memuse', 'GAUGE', 0)
->addDataset('http_memuse', 'GAUGE', 0)
->addDataset('ifdrop_percent', 'GAUGE', 0)
->addDataset('ifdropped', 'DERIVE', 0)
->addDataset('packets', 'DERIVE', 0)
->addDataset('tcp_memuse', 'GAUGE', 0)
->addDataset('tcp_reass_memuse', 'GAUGE', 0)
->addDataset('uptime', 'GAUGE', 0);
// keys that need to by migrated from the instance to the
$instance_keys = [
'af_dcerpc_tcp', 'af_dcerpc_udp', 'af_dhcp', 'af_dns_tcp', 'af_dns_udp', 'af_failed_tcp', 'af_failed_udp', 'af_ftp',
'af_ftp_data', 'af_http', 'af_ikev2', 'af_imap', 'af_krb5_tcp', 'af_krb5_udp', 'af_mqtt', 'af_nfs_tcp', 'af_nfs_udp',
'af_ntp', 'af_rdp', 'af_rfb', 'af_sip', 'af_smb', 'af_smtp', 'af_snmp', 'af_ssh', 'af_tftp', 'af_tls', 'alert',
'at_dcerpc_tcp', 'at_dcerpc_udp', 'at_dhcp', 'at_dns_tcp', 'at_dns_udp', 'at_ftp', 'at_ftp_data', 'at_http', 'at_ikev2',
'at_imap', 'at_krb5_tcp', 'at_krb5_udp', 'at_mqtt', 'at_nfs_tcp', 'at_nfs_udp', 'at_ntp', 'at_rdp', 'at_rfb', 'at_sip',
'at_smb', 'at_smtp', 'at_snmp', 'at_ssh', 'at_tftp', 'at_tls', 'bytes', 'dec_avg_pkt_size', 'dec_chdlc', 'dec_ethernet',
'dec_geneve', 'dec_ieee8021ah', 'dec_invalid', 'dec_ipv4', 'dec_ipv4_in_ipv6', 'dec_ipv6', 'dec_max_pkt_size', 'dec_mpls',
'dec_mx_mac_addrs_d', 'dec_mx_mac_addrs_s', 'dec_packets', 'dec_ppp', 'dec_pppoe', 'dec_raw', 'dec_sctp', 'dec_sll',
'dec_tcp', 'dec_teredo', 'dec_too_many_layer', 'dec_udp', 'dec_vlan', 'dec_vlan_qinq', 'dec_vntag', 'dec_vxlan',
'drop_delta', 'drop_percent', 'dropped', 'error_delta', 'error_percent', 'errors', 'f_icmpv4', 'f_icmpv6', 'f_memuse',
'f_tcp', 'f_udp', 'ftp_memuse', 'http_memuse', 'ifdrop_delta', 'ifdrop_percent', 'ifdropped', 'packet_delta', 'packets',
'tcp_memuse', 'tcp_reass_memuse', 'uptime',
];
// keys to add to the RRD field
$field_keys = [
'af_dcerpc_tcp', 'af_dcerpc_udp', 'af_dhcp', 'af_dns_tcp', 'af_dns_udp', 'af_failed_tcp', 'af_failed_udp', 'af_ftp',
'af_ftp_data', 'af_http', 'af_ikev2', 'af_imap', 'af_krb5_tcp', 'af_krb5_udp', 'af_mqtt', 'af_nfs_tcp', 'af_nfs_udp',
'af_ntp', 'af_rdp', 'af_rfb', 'af_sip', 'af_smb', 'af_smtp', 'af_snmp', 'af_ssh', 'af_tftp', 'af_tls', 'alert',
'at_dcerpc_tcp', 'at_dcerpc_udp', 'at_dhcp', 'at_dns_tcp', 'at_dns_udp', 'at_ftp', 'at_ftp_data', 'at_http', 'at_ikev2',
'at_imap', 'at_krb5_tcp', 'at_krb5_udp', 'at_mqtt', 'at_nfs_tcp', 'at_nfs_udp', 'at_ntp', 'at_rdp', 'at_rfb', 'at_sip',
'at_smb', 'at_smtp', 'at_snmp', 'at_ssh', 'at_tftp', 'at_tls', 'bytes', 'dec_avg_pkt_size', 'dec_chdlc', 'dec_ethernet',
'dec_geneve', 'dec_ieee8021ah', 'dec_invalid', 'dec_ipv4', 'dec_ipv4_in_ipv6', 'dec_ipv6', 'dec_max_pkt_size', 'dec_mpls',
'dec_mx_mac_addrs_d', 'dec_mx_mac_addrs_s', 'dec_packets', 'dec_ppp', 'dec_pppoe', 'dec_raw', 'dec_sctp', 'dec_sll',
'dec_tcp', 'dec_teredo', 'dec_too_many_layer', 'dec_udp', 'dec_vlan', 'dec_vlan_qinq', 'dec_vntag', 'dec_vxlan',
'drop_percent', 'dropped', 'error_percent', 'errors', 'f_icmpv4', 'f_icmpv6', 'f_memuse',
'f_tcp', 'f_udp', 'ftp_memuse', 'http_memuse', 'ifdrop_percent', 'ifdropped', 'packets',
'tcp_memuse', 'tcp_reass_memuse', 'uptime',
];
// process each instance
$instances = [];
foreach ($suricata['data'] as $instance => $stats) {
if ($instance == '.total') {
$rrd_name = ['app', $name, $app->app_id];
} else {
$rrd_name = ['app', $name, $app->app_id, $instance];
$instances[] = $instance;
}
foreach ($instance_keys as $metric_key) {
$metrics[$instance . '_' . $metric_key] = $stats[$metric_key];
}
$fields = [];
foreach ($field_keys as $field_key) {
$fields[$field_key] = $stats[$field_key];
}
$tags = ['name' => $name, 'app_id' => $app->app_id, 'rrd_def' => $rrd_def, 'rrd_name' => $rrd_name];
data_update($device, 'app', $tags, $fields);
}
// check for added or removed instances
$old_instances = $app->data['instances'] ?? [];
$added_instances = array_diff($instances, $old_instances);
$removed_instances = array_diff($old_instances, $instances);
// if we have any source instances, save and log
if (count($added_instances) > 0 || count($removed_instances) > 0) {
$app->data = ['instances' => $instances];
$log_message = 'Suricata Instance Change:';
$log_message .= count($added_instances) > 0 ? ' Added ' . implode(',', $added_instances) : '';
$log_message .= count($removed_instances) > 0 ? ' Removed ' . implode(',', $added_instances) : '';
log_event($log_message, $device, 'application');
}
//
// all done so update the app metrics
//
update_application($app, 'OK', $metrics);
Reference in New Issue View Git Blame Copy Permalink