mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-01 22:58:12 +00:00
Priority level internal handling
Handle internally as ints, then translate as appropriate in outputs
This commit is contained in:
@@ -160,7 +160,7 @@ local function normalize_level(level)
|
|||||||
level = string.lower(level)
|
level = string.lower(level)
|
||||||
for i,v in ipairs(valid_levels) do
|
for i,v in ipairs(valid_levels) do
|
||||||
if (string.find(v, "^"..level)) then
|
if (string.find(v, "^"..level)) then
|
||||||
return v
|
return i - 1 -- (syslog levels start at 0, lua indices start at 1)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
error("Invalid severity level: "..level)
|
error("Invalid severity level: "..level)
|
||||||
|
@@ -1,17 +1,22 @@
|
|||||||
local mod = {}
|
local mod = {}
|
||||||
|
|
||||||
|
levels = {"Emergency", "Alert", "Critical", "Error", "Warning", "Notice", "Informational", "Debug"}
|
||||||
|
|
||||||
function mod.stdout(evt, level, format)
|
function mod.stdout(evt, level, format)
|
||||||
format = "%evt.time: "..level.." "..format
|
format = "%evt.time: "..levels[level+1].." "..format
|
||||||
formatter = digwatch.formatter(format)
|
formatter = digwatch.formatter(format)
|
||||||
msg = digwatch.format_event(evt, formatter)
|
msg = digwatch.format_event(evt, formatter)
|
||||||
print (msg)
|
print (msg)
|
||||||
end
|
end
|
||||||
|
|
||||||
function mod.syslog(evt, level, format)
|
function mod.syslog(evt, level, format)
|
||||||
|
-- https://neopallium.github.io/nixio/modules/nixio.html#nixio.syslog
|
||||||
|
levels = {"emerg", "alert", "crit", "err", "warning", "notice", "info", "debug"}
|
||||||
|
|
||||||
nixio = require("nixio")
|
nixio = require("nixio")
|
||||||
formatter = digwatch.formatter(format)
|
formatter = digwatch.formatter(format)
|
||||||
msg = digwatch.format_event(evt, formatter)
|
msg = digwatch.format_event(evt, formatter)
|
||||||
nixio.syslog(level, msg)
|
nixio.syslog(levels[level+1], msg)
|
||||||
end
|
end
|
||||||
|
|
||||||
return mod
|
return mod
|
||||||
|
Reference in New Issue
Block a user