mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-23 10:57:59 +00:00
Add file output
This commit is contained in:
@@ -8,8 +8,8 @@ syslog_output:
|
||||
enabled: false
|
||||
|
||||
file_output:
|
||||
enabled: false
|
||||
filename: "bla.bla"
|
||||
enabled: true
|
||||
filename: ./events.txt
|
||||
|
||||
stdout_output:
|
||||
enabled: true
|
||||
|
@@ -184,8 +184,7 @@ void add_output(lua_State *ls, output_config oc)
|
||||
if(lua_pcall(ls, nargs, 0, 0) != 0)
|
||||
{
|
||||
const char* lerr = lua_tostring(ls, -1);
|
||||
string err = "Error invoking add_output: " + string(lerr);
|
||||
throw sinsp_exception(err);
|
||||
throw sinsp_exception(string(lerr));
|
||||
}
|
||||
|
||||
}
|
||||
|
@@ -9,6 +9,29 @@ function mod.stdout(evt, level, format)
|
||||
print (msg)
|
||||
end
|
||||
|
||||
function mod.file_validate(options)
|
||||
if (not type(options.filename) == 'string') then
|
||||
error("File output needs to be configured with a valid filename")
|
||||
end
|
||||
|
||||
file, err = io.open(options.filename, "a+")
|
||||
if file == nil then
|
||||
error("Error with file output: "..err)
|
||||
end
|
||||
file:close()
|
||||
|
||||
end
|
||||
|
||||
function mod.file(evt, level, format, options)
|
||||
format = "%evt.time: "..levels[level+1].." "..format
|
||||
formatter = digwatch.formatter(format)
|
||||
msg = digwatch.format_event(evt, formatter)
|
||||
|
||||
file = io.open(options.filename, "a+")
|
||||
file:write(msg, "\n")
|
||||
file:close()
|
||||
end
|
||||
|
||||
function mod.syslog(evt, level, format)
|
||||
|
||||
formatter = digwatch.formatter(format)
|
||||
|
@@ -168,6 +168,12 @@ function add_output(output_name, config)
|
||||
error("rule_loader.add_output(): invalid output_name: "..output_name)
|
||||
end
|
||||
|
||||
-- outputs can optionally define a validation function so that we don't
|
||||
-- find out at runtime (when an event finally matches a rule!) that the config is invalid
|
||||
if (type(output_functions[output_name.."_validate"]) == 'function') then
|
||||
output_functions[output_name.."_validate"](config)
|
||||
end
|
||||
|
||||
table.insert(outputs, {output = output_functions[output_name], config=config})
|
||||
end
|
||||
|
||||
|
Reference in New Issue
Block a user