Skip to content

Instantly share code, notes, and snippets.

@linuxmail

linuxmail/check_graylog_json.sh

Last active January 24, 2020 11:27
Show Gist options
  • Save linuxmail/82c2c560daa5efb6a7c35fb29bf4b2c3 to your computer and use it in GitHub Desktop.
Save linuxmail/82c2c560daa5efb6a7c35fb29bf4b2c3 to your computer and use it in GitHub Desktop.
Download ZIP
Check graylog stream for firewall blocks
Raw
check_graylog_json.sh
#!/bin/sh
# STREAM_ID needs to be replaced with Graylog STREAMID.
DC1_FGT_DENY="$(curl -s --netrc-file /etc/icinga2/secrets/graylog_auth_file -k -H 'Accept: application/json' -X GET "https://dc1-graylog.example.com:443/api/search/universal/relative?query=deny&range=60&filter=streams%3ASTREAM_ID&fields=action%2Cmessage" | jq '.total_results')"
DC2_FGT_DENY="$(curl -s --netrc-file /etc/icinga2/secrets/graylog_auth_file -k -H 'Accept: application/json' -X GET "https://dc2-graylog.example.com:443/api/search/universal/relative?query=deny&range=60&filter=streams%3ASTREAMD_ID&fields=action%2Cmessage" | jq '.total_results')"
echo "Blocked packages: DC1 $DC1_FGT_DENY, DC2 $DC2_FGT_DENY|dc1=$DC1_FGT_DENY dc2=$DC2_FGT_DENY"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment