diff --git a/digwatch.yaml b/digwatch.yaml index 5a5e8df7..9d5c98f5 100644 --- a/digwatch.yaml +++ b/digwatch.yaml @@ -8,8 +8,8 @@ syslog_output: enabled: false file_output: - enabled: false - filename: "bla.bla" + enabled: true + filename: ./events.txt stdout_output: enabled: true diff --git a/userspace/digwatch/digwatch.cpp b/userspace/digwatch/digwatch.cpp index 86aa8de9..0a963106 100644 --- a/userspace/digwatch/digwatch.cpp +++ b/userspace/digwatch/digwatch.cpp @@ -184,8 +184,7 @@ void add_output(lua_State *ls, output_config oc) if(lua_pcall(ls, nargs, 0, 0) != 0) { const char* lerr = lua_tostring(ls, -1); - string err = "Error invoking add_output: " + string(lerr); - throw sinsp_exception(err); + throw sinsp_exception(string(lerr)); } } diff --git a/userspace/digwatch/lua/output.lua b/userspace/digwatch/lua/output.lua index a15d89c2..5863b297 100644 --- a/userspace/digwatch/lua/output.lua +++ b/userspace/digwatch/lua/output.lua @@ -9,6 +9,29 @@ function mod.stdout(evt, level, format) print (msg) end +function mod.file_validate(options) + if (not type(options.filename) == 'string') then + error("File output needs to be configured with a valid filename") + end + + file, err = io.open(options.filename, "a+") + if file == nil then + error("Error with file output: "..err) + end + file:close() + +end + +function mod.file(evt, level, format, options) + format = "%evt.time: "..levels[level+1].." "..format + formatter = digwatch.formatter(format) + msg = digwatch.format_event(evt, formatter) + + file = io.open(options.filename, "a+") + file:write(msg, "\n") + file:close() +end + function mod.syslog(evt, level, format) formatter = digwatch.formatter(format) diff --git a/userspace/digwatch/lua/rule_loader.lua b/userspace/digwatch/lua/rule_loader.lua index 5eb87cce..b39069c5 100644 --- a/userspace/digwatch/lua/rule_loader.lua +++ b/userspace/digwatch/lua/rule_loader.lua @@ -168,6 +168,12 @@ function add_output(output_name, config) error("rule_loader.add_output(): invalid output_name: "..output_name) end + -- outputs can optionally define a validation function so that we don't + -- find out at runtime (when an event finally matches a rule!) that the config is invalid + if (type(output_functions[output_name.."_validate"]) == 'function') then + output_functions[output_name.."_validate"](config) + end + table.insert(outputs, {output = output_functions[output_name], config=config}) end