Nagios Support Forum

Code: Select all

#!/usr/bin/python

import socket
try:
        import json
except ImportError:
        import simplejson as json

logserver_ip   = '192.168.5.100'
logserver_port = 2057
json_message   = {}

json_message['message']    = 'test'
json_message['sourcetype'] = 'Appl-Test'
json_message['logfile']    = '/tmp/test.log'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((logserver_ip, logserver_port))
#s.send(json.dumps(json_message))
s.send((json.dumps(json_message) + '\n'))
s.close()

Code: Select all

{
  "id": 1,
  "gender": "Female",
  "first_name": "Rachel",
  "last_name": "Porter",
  "email": "[email protected]",
  "ip_address": "243.123.228.116"
}, {
  "id": 2,
  "gender": "Male",
  "first_name": "Fred",
  "last_name": "Dunn",
  "email": "[email protected]",
  "ip_address": "106.47.41.159"
}, {
  "id": 3,
  "gender": "Female",
  "first_name": "Brenda",
  "last_name": "Alvarez",
  "email": "[email protected]",
  "ip_address": "134.95.107.229"
}

Code: Select all

 cat 90-nagioslogserver_var_log_ssoAudit.log.conf
$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/lib/rsyslog

# Input for ssoAudit
$InputFileName /var/log/ssoAudit.log
$InputFileTag ssoAudit:
$InputFileStateFile nls-state-var_log_ssoAudit.log # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages
# from this file.
#$InputFileSeverity info
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

$template ls_json,"{%timestamp:::date-rfc3339,jsonf:@timestamp%,%source:::jsonf:@source_host%,\"@source\":\"syslog://%fromhost-ip:::json%\",\"@message\":\"%timestamp% %app-name%:%msg:::json%\",\"@fields\":{%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%}}"


# Forward to Nagios Log Server and then discard, otherwise these messages
# will end up in the syslog file (/var/log/messages) unless there are other
# overriding rules.
if $programname == 'ssoAudit' then @@brnagiosls1.ux.corp.local:2057;ls_json
if $programname == 'ssoAudit' then ~

Code: Select all

{
  "_index": "logstash-2016.04.08",
  "_type": "import_json",
  "_id": "AVP3cA5MGlbcNFEpbl_z",
  "_score": null,
  "_source": {
    "@timestamp": "2016-04-08T19:53:46.208Z",
    "@source_host": "brnagios1",
    "@source": "syslog://",
    "@message": "Apr  8 15:53:46 ssoAudit:  \"gender\": \"Female\",",
    "@fields": {
      "facility": "local0",
      "severity": "notice",
      "program": "ssoAudit",
      "processid": "-"
    },
    "@version": "1",
    "host": "10.10.25.39",
    "type": "import_json",
    "tags": [
      "import_json",
      "_grokparsefailure"
    ],
    "syslog_severity_code": 5,
    "syslog_facility_code": 1,
    "syslog_facility": "user-level",
    "syslog_severity": "notice"
  },
  "sort": [
    1460145226208,
    1460145226208
  ]
}

Code: Select all

$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup sys
$WorkDirectory /var/lib/rsyslog

# Input for ssoAudit
$InputFileName /apps/forgerock/openam-config/auth/debug/ssoAudit.log
$InputFileTag ssoAudit:
$InputFileStateFile ssoAudit.log # Must be unique for each file being polled
# Uncomment the folowing line to override the default severity for messages
# from this file.
#$InputFileSeverity info
#$InputFilePersistStateInterval 20000
$InputFileSeverity error
$InputFileFacility local7
$InputRunFileMonitor

# Forward to Nagios Log Server and then discard, otherwise these messages
# will end up in the syslog file (/var/log/messages) unless there are other
# overriding rules.
if $programname == 'ssoAudit' then @@brnagiosls1.ux.corp.local:2057
if $programname == 'ssoAudit' then stop

Code: Select all

<187>Apr  8 13:24:19 slfroamd1 ssoAudit: {"employeeId":"couldn\u0027t retireve the emplID, persistntID is ","companyId":"couldn\u0027t retireve the companyID for persistantID \u003d ","timeStamp":"2016/04/07 13:11:48 Pacific Daylight Time","userIP":"10.30.27.85","environment":"ssodev.t.com","serverIP":"10.30.27.131","application":"SSO","feature":"CLIENT INTIATED SSO","resource":"smoketest","method":"POST","statusCode":200,"userAgentInfo":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4"}