jonuwz

FROM splunk/splunk:9.0.4.1

HEALTHCHECK --interval=60s --timeout=60s --start-period=60s \
   CMD curl -s -k -f --retry 3 --retry-connrefused --max-time 3 --retry-delay 5 --retry-max-time 60 "https://localhost:8089/" -o /dev/null -w "%{http_code}" && whoami || bash -c 'whoami;kill -s 15 1 && (sleep 10; kill -s 9 1)'

jonuwz

On rhel 8
==========

mkdir /build
cd /build
VER="syslog-ng-4.7.1"
export PREFIX="/usr/local/$VER"

dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
dnf --enablerepo=codeready-builder-for-rhel-8-x86_64-rpms install -y $(echo "

jonuwz

RHEL 8 on WSL
================

https://console.redhat.com/preview

Make sure 'preview' is enabled in the top right

Services->Deploy->Images

Create Blueprint

jonuwz

#!/usr/bin/env python

# --------------------------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for license information.
# --------------------------------------------------------------------------------------------

"""
An example to show receiving events from an Event Hub.

jonuwz

template(
  name="RSYSLOG_SyslogProtocol23Format_NoHead"
  type="string"
  string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
)

template (name="DynFile" type="string" string="/var/log/docker/%app-name%.log")

template(
  name="MSG_only"

jonuwz

Notes on RPM signatures.

Background 
-----------

Yum is not rpm.
Yum trusts signatures on yum repository metadata.
Rpm trusts signatures on individual rpm packages.

They have separate keyrings.

jonuwz

#!/usr/bin/env python3
"""
This mimics an api where you fetch audit logs for a particular time range.
The /audit path accepts 2 query parameters, 'start' and 'end'
These are the start and end times for the query, expressed as an epoch
start defaults to 0
end defaults to now

10 random logs are returned between these times

jonuwz

# pip install azure-mgmt-resource azure-identity
import os
import json
from azure.mgmt.resource import SubscriptionClient
from azure.identity import ClientSecretCredential

active_dict= {}

t_id = ''
username = ''

jonuwz

/*
 * Copyright 2011 Splunk, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"): you may
 * not use this file except in compliance with the License. You may obtain
 * a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software

jonuwz

options {
    flush_lines (0);
    time_reopen (10);
    log_fifo_size (1000);
    chain_hostnames (off);
    use_dns (no);
    use_fqdn (no);
    create_dirs (no);
    keep_hostname (yes);
};