Code

[Auditbeat] Login metricset#9327

Code

Merged

cwurm merged 54 commits intoelastic:masterelastic/beats:masterfrom cwurm:logins_metrisetcwurm/beats:logins_metrisetCopy head branch name to clipboardJan 30, 2019

+1,164-6

Commits

Commits on Jan 29, 2019

• First working version.

  

  Christoph Wurm

  committed
  2774cbc

• Use filepath pattern to catch rotated files.

  

  Christoph Wurm

  committed
  172273a

• Add state.

  

  Christoph Wurm

  committed
  1cf7585

• Test data.

  

  Christoph Wurm

  committed
  81831e2

• Exclude empty fields from event.

  

  Christoph Wurm

  committed
  bd03a7f

• TTY lookup.

  

  Christoph Wurm

  committed
  a657a25

• UTMP debug log.

  

  Christoph Wurm

  committed
  7675662

• Add LoginRecord.UID.

  

  Christoph Wurm

  committed
  4f712a7

• Move structs to their proper files.

  

  Christoph Wurm

  committed
  980225b

• Move FileRecord to utmp.go.

  

  Christoph Wurm

  committed
  feb3685

• Move most logic to utmp.go.

  

  Christoph Wurm

  committed
  f7dcb48

• Properly separate logic, add all event logic.

  

  Christoph Wurm

  committed
  1051f20

• Add TODO comments.

  

  Christoph Wurm

  committed
  eb9c40a

• Use top-level fields where possible.

  

  Christoph Wurm

  committed
  e467633

• Update test data.

  

  Christoph Wurm

  committed
  126230b

• Update fields.yml.

  

  Christoph Wurm

  committed
  760d46e

• Minor improvements.

  

  Christoph Wurm

  committed
  4cfac44

• Config.

  

  Christoph Wurm

  committed
  a54c658

• Hound fixes.

  

  Christoph Wurm

  committed
  2f0bc9d

• Add cgo to build tags.

  

  Christoph Wurm

  committed
  e05e58f

• Change event.summary to message.

  

  Christoph Wurm

  committed
  0b2c555

• Revert validate:required.

  

  Christoph Wurm

  committed
  944b9ce

• Change to source.domain.

  

  Christoph Wurm

  committed
  6e446d5

• Change constants to loginRecordType.

  

  Christoph Wurm

  committed
  7cc8c03

• Remove fileInfos().

  

  Christoph Wurm

  committed
  6bdb263

• mage update

  

  Christoph Wurm

  committed
  ea48b62

• Config and docs adjustments.

  

  Christoph Wurm

  committed
  51194c2

• Lowercase config.

  

  Christoph Wurm

  committed
  6680660

• Namespace

  

  Christoph Wurm

  committed
  e0c66da

• Addressed some minor review comments.

  

  Christoph Wurm

  committed
  e602899

• Pure Go reader.

  

  Christoph Wurm

  committed
  7fa836f

• Remove now unneeded seccomp action.

  

  Christoph Wurm

  committed
  ad2220f

• Make file re-reading non-recursive.

  

  Christoph Wurm

  committed
  1458563

• Use channels instead of passing arrays to reduce memory footprint.

  

  Christoph Wurm

  committed
  a7ca217

• Save offset instead of last read record.

  

  Christoph Wurm

  committed
  0823d7e

• Handle failed logins from btmp files as well.

  

  Christoph Wurm

  committed
  9c9e1b6

• System test

  

  Christoph Wurm

  committed
  9774ca0

• Remove unreachable code.

  

  Christoph Wurm

  committed
  04af736

• Make Hound happy

  

  Christoph Wurm

  committed
  3b8ed59

• Change to user.terminal and document event.origin

  

  Christoph Wurm

  committed
  175c992

• Config and docs.

  

  Christoph Wurm

  committed
  3b8002a

• Changelog

  

  Christoph Wurm

  committed
  1a8bbbc

• Update data.json

  

  Christoph Wurm

  committed
  5915f85

• Test with samle wtmp file.

  

  Christoph Wurm

  committed
  3617549

• Remove cgo build constraint.

  

  Christoph Wurm

  committed
  3e21182

• Improve message string building.

  

  Christoph Wurm

  committed
  03eedee

• Add UtType.

  

  Christoph Wurm

  committed
  539feb4

• Respect machine byte order.

  

  Christoph Wurm

  committed
  0453ce2

• Fix debug message.

  

  Christoph Wurm

  committed
  028663d

• Correct type for all UtType values.

  

  Christoph Wurm

  committed
  c649510

• Skip login dataset tests when not on a little-endian system.

  

  Christoph Wurm

  committed
  b1f70fb

• mage update

  

  Christoph Wurm

  committed
  fe229c7

• Remove user.id from system test.

  

  Christoph Wurm

  committed
  71d61c2

Commits on Jan 30, 2019

• Fix unit test in integration env.

  

  Christoph Wurm

  committed
  d0b1969