lib/fluent/plugin/viaq_docker_audit.rb
# Takes one line from audit.log and returns hash
# that fits the OAL format.
# Messages of other types than 'virt_control' are ignored.
Takes one line from audit.log and returns hash
that fits the OAL format.
Messages of other types than 'virt_control' are ignored.
Takes one line from audit . log and returns hash that fits the OAL format . Messages of other types than ' virt_control ' are ignored .
def parse_audit_line(line)
      if filter_virt_control(line)
        event = {}
        docker = {}
        if (metadata = /(?<g1>.*?) msg='(?<g2>.*?)'/.match(line)) && !metadata['g1'].nil? && !metadata['g2'].nil?
          parse_metadata(event, metadata['g1'].split)
          parse_msg(docker, metadata['g2'].split)
          event[IN_EVENT_TYPE] = docker
        else
          raise ViaqDockerAuditParserException, "Couldn't parse message: #{line}"
        end
        return normalize(event)
      end
      return nil
    end
def parse_audit_line ( line ) if filter_virt_control ( line ) event = { } docker = { } if ( metadata = / (?<g1>.*?) msg='(?<g2>.*?)' / . match ( line ) ) && ! metadata [ 'g1' ] . nil? && ! metadata [ 'g2' ] . nil? parse_metadata ( event , metadata [ 'g1' ] . split ) parse_msg ( docker , metadata [ 'g2' ] . split ) event [ IN_EVENT_TYPE ] = docker else raise ViaqDockerAuditParserException , "Couldn't parse message: #{line}" end return normalize ( event ) end return nil end
Takes one line from audit.log and returns hash
that fits the OAL format.
Takes one line from audit . log and returns hash that fits the OAL format .
line