{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1961","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1961/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1961/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1961/events","html_url":"https://github.com/facebook/osquery/pull/1961","id":143109800,"number":1961,"title":"Add syslog table for querying of rsyslog logs","user":{"login":"zwass","id":575602,"avatar_url":"https://avatars.githubusercontent.com/u/575602?v=3","gravatar_id":"","url":"https://api.github.com/users/zwass","html_url":"https://github.com/zwass","followers_url":"https://api.github.com/users/zwass/followers","following_url":"https://api.github.com/users/zwass/following{/other_user}","gists_url":"https://api.github.com/users/zwass/gists{/gist_id}","starred_url":"https://api.github.com/users/zwass/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zwass/subscriptions","organizations_url":"https://api.github.com/users/zwass/orgs","repos_url":"https://api.github.com/users/zwass/repos","events_url":"https://api.github.com/users/zwass/events{/privacy}","received_events_url":"https://api.github.com/users/zwass/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/CLA%20Signed","name":"CLA Signed","color":"009900"},{"url":"https://api.github.com/repos/facebook/osquery/labels/events","name":"events","color":"207de5"},{"url":"https://api.github.com/repos/facebook/osquery/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/facebook/osquery/labels/Linux","name":"Linux","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-03-24T00:00:08Z","updated_at":"2016-03-29T06:07:56Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1961","html_url":"https://github.com/facebook/osquery/pull/1961","diff_url":"https://github.com/facebook/osquery/pull/1961.diff","patch_url":"https://github.com/facebook/osquery/pull/1961.patch"},"body":"This PR adds a new event-based table for querying linux syslog events forwarded through rsyslog. As discussed, expiration of events for this table can be controlled separately from that of other event-based tables.\r\n\r\nUpon initialization, the event publisher tries to create a named pipe at `/var/osquery/syslog_pipe` (configurable by CLI flag), and then begins reading logs forwarded to the pipe. Rsyslog must be configured to forward logs to the pipe (instructions for doing this will be added to the wiki).\r\n\r\nIt has been tested successfully on Ubuntu12/14, centos7.1 and RHEL7.2 (which were all of the linux distros I was able to get osquery to build on).\r\n\r\n```\r\nosquery> select * from syslog order by time desc limit 5;\r\n+------------+--------------------------+----------+----------+------+--------------------------------------------------------------------------------------------------+\r\n| time       | host                     | severity | facility | tag  | message                                                                                          |\r\n+------------+--------------------------+----------+----------+------+--------------------------------------------------------------------------------------------------+\r\n| 1458939721 | vagrant-ubuntu-trusty-64 | 5        | authpriv | sudo | vagrant : TTY=pts/0 ; PWD=/vagrant ; USER=root ; COMMAND=./build/trusty/osquery/osqueryi --debug |\r\n| 1458939721 | vagrant-ubuntu-trusty-64 | 6        | authpriv | sudo | pam_unix(sudo:session): session opened for user root by vagrant(uid=0)                           |\r\n| 1458939715 | vagrant-ubuntu-trusty-64 | 6        | authpriv | sudo | pam_unix(sudo:session): session closed for user root                                             |\r\n| 1458939703 | vagrant-ubuntu-trusty-64 | 5        | authpriv | sudo | vagrant : TTY=pts/0 ; PWD=/vagrant ; USER=root ; COMMAND=./build/linux/osquery/osqueryi --debug  |\r\n| 1458939703 | vagrant-ubuntu-trusty-64 | 6        | authpriv | sudo | pam_unix(sudo:session): session opened for user root by vagrant(uid=0)                           |\r\n+------------+--------------------------+----------+----------+------+--------------------------------------------------------------------------------------------------+\r\n```\r\n\r\nCommits will be squashed before merging."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/202727264","html_url":"https://github.com/facebook/osquery/pull/1961#issuecomment-202727264","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1961","id":202727264,"user":{"login":"mtmcgrew","id":2164097,"avatar_url":"https://avatars.githubusercontent.com/u/2164097?v=3","gravatar_id":"","url":"https://api.github.com/users/mtmcgrew","html_url":"https://github.com/mtmcgrew","followers_url":"https://api.github.com/users/mtmcgrew/followers","following_url":"https://api.github.com/users/mtmcgrew/following{/other_user}","gists_url":"https://api.github.com/users/mtmcgrew/gists{/gist_id}","starred_url":"https://api.github.com/users/mtmcgrew/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtmcgrew/subscriptions","organizations_url":"https://api.github.com/users/mtmcgrew/orgs","repos_url":"https://api.github.com/users/mtmcgrew/repos","events_url":"https://api.github.com/users/mtmcgrew/events{/privacy}","received_events_url":"https://api.github.com/users/mtmcgrew/received_events","type":"User","site_admin":false},"created_at":"2016-03-29T06:07:56Z","updated_at":"2016-03-29T06:07:56Z","body":"Can we add a column that holds the raw syslog message? It would be nice for use-cases that want to forward the raw syslog message and do further processing downstream."}}