forked from mirrors/nixpkgs
01b8c48c32
The special handling for cronjobs should probably move to the cron module (logcheckIgnore = bool option) in the future, as it's more natural to just declare a cronjob, and mark it as "log-ignored", instead of adding cronjobs through logcheck. But as systemCronjobs is not an attrset yet (just simple strings), this would require adding an attrset for cronjobs or parsing strings in the nix language to get hold of the cron-user and command. So for now, I keep the interface within logcheck's module.
232 lines
6.2 KiB
Nix
232 lines
6.2 KiB
Nix
{config, pkgs, ...}:
|
|
|
|
with pkgs.lib;
|
|
|
|
let
|
|
cfg = config.services.logcheck;
|
|
|
|
defaultRules = pkgs.runCommand "logcheck-default-rules" {} ''
|
|
cp -prd ${pkgs.logcheck}/etc/logcheck $out
|
|
chmod u+w $out
|
|
rm $out/logcheck.*
|
|
'';
|
|
|
|
rulesDir = pkgs.symlinkJoin "logcheck-rules-dir" ([ defaultRules ] ++ cfg.extraRulesDirs);
|
|
|
|
configFile = pkgs.writeText "logcheck.conf" cfg.config;
|
|
|
|
logFiles = pkgs.writeText "logcheck.logfiles" cfg.files;
|
|
|
|
flags = "-r ${rulesDir} -c ${configFile} -L ${logFiles} -${levelFlag} -m ${cfg.mailTo}";
|
|
|
|
levelFlag = getAttrFromPath [cfg.level]
|
|
{ "paranoid" = "p";
|
|
"server" = "s";
|
|
"workstation" = "w";
|
|
};
|
|
|
|
cronJob = ''
|
|
@reboot logcheck env PATH=/var/setuid-wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
|
|
2 ${cfg.timeOfDay} * * * logcheck env PATH=/var/setuid-wrappers:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
|
|
'';
|
|
|
|
writeIgnoreRule = name: {level, regex, ...}:
|
|
pkgs.writeTextFile
|
|
{ inherit name;
|
|
destination = "/ignore.d.${level}/${name}";
|
|
text = ''
|
|
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ${regex}
|
|
'';
|
|
};
|
|
|
|
writeIgnoreCronRule = name: {level, user, regex, cmdline, ...}:
|
|
let escapeRegex = escape (stringToCharacters "\\[]{}()^$?*+|.");
|
|
cmdline_ = builtins.unsafeDiscardStringContext cmdline;
|
|
re = if regex != "" then regex else if cmdline_ == "" then ".*" else escapeRegex cmdline_;
|
|
in writeIgnoreRule "cron-${name}" {
|
|
inherit level;
|
|
regex = ''
|
|
(/usr/bin/)?cron\[[0-9]+\]: \(${user}\) CMD \(${re}\)$
|
|
'';
|
|
};
|
|
|
|
levelOption = mkOption {
|
|
default = "server";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Set the logcheck level. Either "workstation", "server", or "paranoid".
|
|
'';
|
|
};
|
|
|
|
ignoreOptions = {
|
|
level = levelOption;
|
|
|
|
regex = mkOption {
|
|
default = "";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Regex specifying which log lines to ignore.
|
|
'';
|
|
};
|
|
};
|
|
|
|
ignoreCronOptions = {
|
|
user = mkOption {
|
|
default = "root";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
User that runs the cronjob.
|
|
'';
|
|
};
|
|
|
|
cmdline = mkOption {
|
|
default = "";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Command line for the cron job. Will be turned into a regex for the logcheck ignore rule.
|
|
'';
|
|
};
|
|
|
|
timeArgs = mkOption {
|
|
default = null;
|
|
type = types.nullOr (types.uniq types.string);
|
|
example = "02 06 * * *";
|
|
description = ''
|
|
"min hr dom mon dow" crontab time args, to auto-create a cronjob too.
|
|
Leave at null to not do this and just add a logcheck ignore rule.
|
|
'';
|
|
};
|
|
};
|
|
|
|
in
|
|
{
|
|
options = {
|
|
services.logcheck = {
|
|
enable = mkOption {
|
|
default = false;
|
|
type = types.bool;
|
|
description = ''
|
|
Enable the logcheck cron job.
|
|
'';
|
|
};
|
|
|
|
user = mkOption {
|
|
default = "logcheck";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Username for the logcheck user.
|
|
'';
|
|
};
|
|
|
|
timeOfDay = mkOption {
|
|
default = "*";
|
|
example = "6";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Time of day to run logcheck. A logcheck will be scheduled at xx:02 each day.
|
|
Leave default (*) to run every hour. Of course when nothing special was logged,
|
|
logcheck will be silent.
|
|
'';
|
|
};
|
|
|
|
mailTo = mkOption {
|
|
default = "root";
|
|
example = "you@domain.com";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Email address to send reports to.
|
|
'';
|
|
};
|
|
|
|
level = mkOption {
|
|
default = "server";
|
|
type = types.uniq types.string;
|
|
description = ''
|
|
Set the logcheck level. Either "workstation", "server", or "paranoid".
|
|
'';
|
|
};
|
|
|
|
config = mkOption {
|
|
default = "FQDN=1";
|
|
type = types.string;
|
|
description = ''
|
|
Config options that you would like in logcheck.conf.
|
|
'';
|
|
};
|
|
|
|
files = mkOption {
|
|
default = [ "/var/log/messages" ];
|
|
type = types.listOf types.path;
|
|
example = [ "/var/log/messages" "/var/log/mail" ];
|
|
description = ''
|
|
Which log files to check.
|
|
'';
|
|
};
|
|
|
|
extraRulesDirs = mkOption {
|
|
default = [];
|
|
example = "/etc/logcheck";
|
|
type = types.listOf types.path;
|
|
description = ''
|
|
Directories with extra rules.
|
|
'';
|
|
};
|
|
|
|
ignore = mkOption {
|
|
default = {};
|
|
description = ''
|
|
This option defines extra ignore rules.
|
|
'';
|
|
type = types.loaOf types.optionSet;
|
|
options = [ ignoreOptions ];
|
|
};
|
|
|
|
ignoreCron = mkOption {
|
|
default = {};
|
|
description = ''
|
|
This option defines extra ignore rules for cronjobs.
|
|
'';
|
|
type = types.loaOf types.optionSet;
|
|
options = [ ignoreOptions ignoreCronOptions ];
|
|
};
|
|
|
|
extraGroups = mkOption {
|
|
default = [];
|
|
type = types.listOf types.string;
|
|
example = [ "postdrop" "mongodb" ];
|
|
description = ''
|
|
Extra groups for the logcheck user, for example to be able to use sendmail,
|
|
or to access certain log files.
|
|
'';
|
|
};
|
|
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
services.logcheck.extraRulesDirs =
|
|
mapAttrsToList writeIgnoreRule cfg.ignore
|
|
++ mapAttrsToList writeIgnoreCronRule cfg.ignoreCron;
|
|
|
|
users.extraUsers = singleton
|
|
{ name = cfg.user;
|
|
shell = "/bin/sh";
|
|
description = "Logcheck user account";
|
|
extraGroups = cfg.extraGroups;
|
|
};
|
|
|
|
system.activationScripts.logcheck = ''
|
|
mkdir -m 700 -p /var/{lib,lock}/logcheck
|
|
chown ${cfg.user} /var/{lib,lock}/logcheck
|
|
'';
|
|
|
|
services.cron.systemCronJobs =
|
|
let withTime = name: {timeArgs, ...}: ! (builtins.isNull timeArgs);
|
|
mkCron = name: {user, cmdline, timeArgs, ...}: ''
|
|
${timeArgs} ${user} ${cmdline}
|
|
'';
|
|
in mapAttrsToList mkCron (filterAttrs withTime cfg.ignoreCron)
|
|
++ [ cronJob ];
|
|
};
|
|
}
|