github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-08 09:37:58 +00:00
Code Issues Projects Releases Wiki Activity

Initial version of outputs.lua

Browse Source
This commit is contained in:
Henri DF 2016-03-03 16:13:08 -08:00
parent 7593aac4c9
commit 331042858f
1 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
userspace/digwatch/lua/output.lua Normal file
View File

@ -0,0 +1,30 @@
local mod = {}
function mod.syslog(evt, level, format)
nixio = require("nixio")
formatter = digwatch.formatter(format)
msg = digwatch.format_event(evt, formatter)
nixio.syslog(level, msg)
end
local first_sequence_state = {}
function mod.first_sequence(evt, fieldname, key, format)
local field_value = digwatch.field(evt, fieldname)
local now = os.time()
if first_sequence_state[key] == nil then
first_sequence_state[key] = {}
end
if first_sequence_state[key][field_value] == nil or
now - first_sequence_state[key][field_value] > 5 then
formatter = digwatch.formatter(format)
msg = digwatch.format_event(evt, formatter)
print (msg)
end
first_sequence_state[key][field_value] = now
end
return mod