{"action":"created","comment":{"url":"https://api.github.com/repos/hubblestack/hubble/pulls/comments/177482548","pull_request_review_id":107360961,"id":177482548,"diff_hunk":"@@ -457,6 +461,18 @@ def load_config():\n                                         __opts__['log_level'],\n                                         max_bytes=__opts__.get('logfile_maxbytes', 100000000),\n                                         backup_count=__opts__.get('logfile_backups', 1))\n+    logging.SPLUNK = 25 # logs below warning, above info\n+    logging.addLevelName(logging.SPLUNK, 'SPLUNK')\n+    def splunk(self, message, *args, **kwargs):\n+        if self.isEnabledFor(logging.SPLUNK):\n+            self._log(logging.SPLUNK, message, args, **kwargs)\n+    logging.Logger.splunk = splunk\n+    if __salt__['config.get']('hubblestack:splunklogging', False):\n+        root_logger = logging.getLogger()\n+        handler = hubblestack.splunklogging.SplunkHandler()\n+        handler.setLevel(logging.SPLUNK)\n+        root_logger.addHandler(handler)\n+","path":"hubblestack/daemon.py","position":60,"original_position":60,"commit_id":"c052ec2ebb2672d613890263c88af73079645fdc","original_commit_id":"c052ec2ebb2672d613890263c88af73079645fdc","user":{"login":"basepi","id":702318,"avatar_url":"https://avatars2.githubusercontent.com/u/702318?v=4","gravatar_id":"","url":"https://api.github.com/users/basepi","html_url":"https://github.com/basepi","followers_url":"https://api.github.com/users/basepi/followers","following_url":"https://api.github.com/users/basepi/following{/other_user}","gists_url":"https://api.github.com/users/basepi/gists{/gist_id}","starred_url":"https://api.github.com/users/basepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basepi/subscriptions","organizations_url":"https://api.github.com/users/basepi/orgs","repos_url":"https://api.github.com/users/basepi/repos","events_url":"https://api.github.com/users/basepi/events{/privacy}","received_events_url":"https://api.github.com/users/basepi/received_events","type":"User","site_admin":false},"body":"I think you want the errors and warnings in splunk -- even if you ignore them most of the time I think they are going go be useful to have when debugging issues for your customers. Any that explicitly aren't useful, like the insecure warnings that we had before we enabled SSL verify should be cleaned up as we see them.\r\n\r\nIf you decide that you don't want that data, we would need to make the `logging.SPLUNK` configurable and then we could set it to a value higher than ERROR so that logging at that level doesn't include anything else. Actually, that's a useful feature anyway, so I think I'll add it today anyway.                                                                                                                                                                                             ","created_at":"2018-03-27T16:08:14Z","updated_at":"2018-03-27T16:08:15Z","html_url":"https://github.com/hubblestack/hubble/pull/317#discussion_r177482548","pull_request_url":"https://api.github.com/repos/hubblestack/hubble/pulls/317","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/hubblestack/hubble/pulls/comments/177482548"},"html":{"href":"https://github.com/hubblestack/hubble/pull/317#discussion_r177482548"},"pull_request":{"href":"https://api.github.com/repos/hubblestack/hubble/pulls/317"}},"in_reply_to_id":177325740},"pull_request":{"url":"https://api.github.com/repos/hubblestack/hubble/pulls/317","id":176636043,"html_url":"https://github.com/hubblestack/hubble/pull/317","diff_url":"https://github.com/hubblestack/hubble/pull/317.diff","patch_url":"https://github.com/hubblestack/hubble/pull/317.patch","issue_url":"https://api.github.com/repos/hubblestack/hubble/issues/317","number":317,"state":"open","locked":false,"title":"osquery timing + custom splunk loglevel + ssl verify for splunk + small fixes","user":{"login":"basepi","id":702318,"avatar_url":"https://avatars2.githubusercontent.com/u/702318?v=4","gravatar_id":"","url":"https://api.github.com/users/basepi","html_url":"https://github.com/basepi","followers_url":"https://api.github.com/users/basepi/followers","following_url":"https://api.github.com/users/basepi/following{/other_user}","gists_url":"https://api.github.com/users/basepi/gists{/gist_id}","starred_url":"https://api.github.com/users/basepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basepi/subscriptions","organizations_url":"https://api.github.com/users/basepi/orgs","repos_url":"https://api.github.com/users/basepi/repos","events_url":"https://api.github.com/users/basepi/events{/privacy}","received_events_url":"https://api.github.com/users/basepi/received_events","type":"User","site_admin":false},"body":"This PR kind of spiraled out of control a little bit. It does a bunch of things.\r\n\r\n# Top changes\r\n\r\n* Time the osquery queries and report to splunk if splunklogging=True\r\n* Add new loglevel for splunk reporting (`splunk`)\r\n* **Turn on SSL verify for the splunk returners and splunklogging.py**\r\n\r\n# Other changes\r\n\r\n* Migrates to salt.utils.path.which (salt 2018.3)\r\n* Migrates to salt.utils.platform.is_windows (salt 2018.3)\r\n* Fixes gen_jid calls (salt 2018.3)\r\n* Improves error reporting if net-tools is not installed on centos\r\n* Fixes a transient issue related to salt's custom log records\r\n* Adds network requires to systemd unit file\r\n* Adds optional sleep on startup as a backup for network startup issues\r\n\r\n@sumanmehta The SSL verify change is potentially a big one and should be tested against your splunk endpoints. If they don't have good certificates, we should either fix that or make the SSL verify configurable and silence the warnings (or else they get logged to splunk, which triggers a new warning, which gets logged to splunk...bad loop).","created_at":"2018-03-21T23:21:40Z","updated_at":"2018-03-27T16:08:15Z","closed_at":null,"merged_at":null,"merge_commit_sha":"079fa484289dfc3bada32db8b58c59fff4951129","assignee":null,"assignees":[],"requested_reviewers":[{"login":"jettero","id":54520,"avatar_url":"https://avatars3.githubusercontent.com/u/54520?v=4","gravatar_id":"","url":"https://api.github.com/users/jettero","html_url":"https://github.com/jettero","followers_url":"https://api.github.com/users/jettero/followers","following_url":"https://api.github.com/users/jettero/following{/other_user}","gists_url":"https://api.github.com/users/jettero/gists{/gist_id}","starred_url":"https://api.github.com/users/jettero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jettero/subscriptions","organizations_url":"https://api.github.com/users/jettero/orgs","repos_url":"https://api.github.com/users/jettero/repos","events_url":"https://api.github.com/users/jettero/events{/privacy}","received_events_url":"https://api.github.com/users/jettero/received_events","type":"User","site_admin":false},{"login":"mew1033","id":4435733,"avatar_url":"https://avatars2.githubusercontent.com/u/4435733?v=4","gravatar_id":"","url":"https://api.github.com/users/mew1033","html_url":"https://github.com/mew1033","followers_url":"https://api.github.com/users/mew1033/followers","following_url":"https://api.github.com/users/mew1033/following{/other_user}","gists_url":"https://api.github.com/users/mew1033/gists{/gist_id}","starred_url":"https://api.github.com/users/mew1033/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mew1033/subscriptions","organizations_url":"https://api.github.com/users/mew1033/orgs","repos_url":"https://api.github.com/users/mew1033/repos","events_url":"https://api.github.com/users/mew1033/events{/privacy}","received_events_url":"https://api.github.com/users/mew1033/received_events","type":"User","site_admin":false},{"login":"madchills","id":19738419,"avatar_url":"https://avatars0.githubusercontent.com/u/19738419?v=4","gravatar_id":"","url":"https://api.github.com/users/madchills","html_url":"https://github.com/madchills","followers_url":"https://api.github.com/users/madchills/followers","following_url":"https://api.github.com/users/madchills/following{/other_user}","gists_url":"https://api.github.com/users/madchills/gists{/gist_id}","starred_url":"https://api.github.com/users/madchills/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/madchills/subscriptions","organizations_url":"https://api.github.com/users/madchills/orgs","repos_url":"https://api.github.com/users/madchills/repos","events_url":"https://api.github.com/users/madchills/events{/privacy}","received_events_url":"https://api.github.com/users/madchills/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/hubblestack/hubble/pulls/317/commits","review_comments_url":"https://api.github.com/repos/hubblestack/hubble/pulls/317/comments","review_comment_url":"https://api.github.com/repos/hubblestack/hubble/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hubblestack/hubble/issues/317/comments","statuses_url":"https://api.github.com/repos/hubblestack/hubble/statuses/c052ec2ebb2672d613890263c88af73079645fdc","head":{"label":"basepi:fixup","ref":"fixup","sha":"c052ec2ebb2672d613890263c88af73079645fdc","user":{"login":"basepi","id":702318,"avatar_url":"https://avatars2.githubusercontent.com/u/702318?v=4","gravatar_id":"","url":"https://api.github.com/users/basepi","html_url":"https://github.com/basepi","followers_url":"https://api.github.com/users/basepi/followers","following_url":"https://api.github.com/users/basepi/following{/other_user}","gists_url":"https://api.github.com/users/basepi/gists{/gist_id}","starred_url":"https://api.github.com/users/basepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basepi/subscriptions","organizations_url":"https://api.github.com/users/basepi/orgs","repos_url":"https://api.github.com/users/basepi/repos","events_url":"https://api.github.com/users/basepi/events{/privacy}","received_events_url":"https://api.github.com/users/basepi/received_events","type":"User","site_admin":false},"repo":{"id":78152356,"name":"hubble","full_name":"basepi/hubble","owner":{"login":"basepi","id":702318,"avatar_url":"https://avatars2.githubusercontent.com/u/702318?v=4","gravatar_id":"","url":"https://api.github.com/users/basepi","html_url":"https://github.com/basepi","followers_url":"https://api.github.com/users/basepi/followers","following_url":"https://api.github.com/users/basepi/following{/other_user}","gists_url":"https://api.github.com/users/basepi/gists{/gist_id}","starred_url":"https://api.github.com/users/basepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basepi/subscriptions","organizations_url":"https://api.github.com/users/basepi/orgs","repos_url":"https://api.github.com/users/basepi/repos","events_url":"https://api.github.com/users/basepi/events{/privacy}","received_events_url":"https://api.github.com/users/basepi/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/basepi/hubble","description":"Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, automated remediation, alerting and reporting.","fork":true,"url":"https://api.github.com/repos/basepi/hubble","forks_url":"https://api.github.com/repos/basepi/hubble/forks","keys_url":"https://api.github.com/repos/basepi/hubble/keys{/key_id}","collaborators_url":"https://api.github.com/repos/basepi/hubble/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/basepi/hubble/teams","hooks_url":"https://api.github.com/repos/basepi/hubble/hooks","issue_events_url":"https://api.github.com/repos/basepi/hubble/issues/events{/number}","events_url":"https://api.github.com/repos/basepi/hubble/events","assignees_url":"https://api.github.com/repos/basepi/hubble/assignees{/user}","branches_url":"https://api.github.com/repos/basepi/hubble/branches{/branch}","tags_url":"https://api.github.com/repos/basepi/hubble/tags","blobs_url":"https://api.github.com/repos/basepi/hubble/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/basepi/hubble/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/basepi/hubble/git/refs{/sha}","trees_url":"https://api.github.com/repos/basepi/hubble/git/trees{/sha}","statuses_url":"https://api.github.com/repos/basepi/hubble/statuses/{sha}","languages_url":"https://api.github.com/repos/basepi/hubble/languages","stargazers_url":"https://api.github.com/repos/basepi/hubble/stargazers","contributors_url":"https://api.github.com/repos/basepi/hubble/contributors","subscribers_url":"https://api.github.com/repos/basepi/hubble/subscribers","subscription_url":"https://api.github.com/repos/basepi/hubble/subscription","commits_url":"https://api.github.com/repos/basepi/hubble/commits{/sha}","git_commits_url":"https://api.github.com/repos/basepi/hubble/git/commits{/sha}","comments_url":"https://api.github.com/repos/basepi/hubble/comments{/number}","issue_comment_url":"https://api.github.com/repos/basepi/hubble/issues/comments{/number}","contents_url":"https://api.github.com/repos/basepi/hubble/contents/{+path}","compare_url":"https://api.github.com/repos/basepi/hubble/compare/{base}...{head}","merges_url":"https://api.github.com/repos/basepi/hubble/merges","archive_url":"https://api.github.com/repos/basepi/hubble/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/basepi/hubble/downloads","issues_url":"https://api.github.com/repos/basepi/hubble/issues{/number}","pulls_url":"https://api.github.com/repos/basepi/hubble/pulls{/number}","milestones_url":"https://api.github.com/repos/basepi/hubble/milestones{/number}","notifications_url":"https://api.github.com/repos/basepi/hubble/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/basepi/hubble/labels{/name}","releases_url":"https://api.github.com/repos/basepi/hubble/releases{/id}","deployments_url":"https://api.github.com/repos/basepi/hubble/deployments","created_at":"2017-01-05T22:10:59Z","updated_at":"2017-01-05T22:11:01Z","pushed_at":"2018-03-26T23:12:16Z","git_url":"git://github.com/basepi/hubble.git","ssh_url":"git@github.com:basepi/hubble.git","clone_url":"https://github.com/basepi/hubble.git","svn_url":"https://github.com/basepi/hubble","homepage":null,"size":1295,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"develop"}},"base":{"label":"hubblestack:develop","ref":"develop","sha":"d79667cc08a13b44ae2821e8bf22b19efa85ce32","user":{"login":"hubblestack","id":17038482,"avatar_url":"https://avatars2.githubusercontent.com/u/17038482?v=4","gravatar_id":"","url":"https://api.github.com/users/hubblestack","html_url":"https://github.com/hubblestack","followers_url":"https://api.github.com/users/hubblestack/followers","following_url":"https://api.github.com/users/hubblestack/following{/other_user}","gists_url":"https://api.github.com/users/hubblestack/gists{/gist_id}","starred_url":"https://api.github.com/users/hubblestack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hubblestack/subscriptions","organizations_url":"https://api.github.com/users/hubblestack/orgs","repos_url":"https://api.github.com/users/hubblestack/repos","events_url":"https://api.github.com/users/hubblestack/events{/privacy}","received_events_url":"https://api.github.com/users/hubblestack/received_events","type":"Organization","site_admin":false},"repo":{"id":78152020,"name":"hubble","full_name":"hubblestack/hubble","owner":{"login":"hubblestack","id":17038482,"avatar_url":"https://avatars2.githubusercontent.com/u/17038482?v=4","gravatar_id":"","url":"https://api.github.com/users/hubblestack","html_url":"https://github.com/hubblestack","followers_url":"https://api.github.com/users/hubblestack/followers","following_url":"https://api.github.com/users/hubblestack/following{/other_user}","gists_url":"https://api.github.com/users/hubblestack/gists{/gist_id}","starred_url":"https://api.github.com/users/hubblestack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hubblestack/subscriptions","organizations_url":"https://api.github.com/users/hubblestack/orgs","repos_url":"https://api.github.com/users/hubblestack/repos","events_url":"https://api.github.com/users/hubblestack/events{/privacy}","received_events_url":"https://api.github.com/users/hubblestack/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hubblestack/hubble","description":"Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, automated remediation, alerting and reporting.","fork":false,"url":"https://api.github.com/repos/hubblestack/hubble","forks_url":"https://api.github.com/repos/hubblestack/hubble/forks","keys_url":"https://api.github.com/repos/hubblestack/hubble/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hubblestack/hubble/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hubblestack/hubble/teams","hooks_url":"https://api.github.com/repos/hubblestack/hubble/hooks","issue_events_url":"https://api.github.com/repos/hubblestack/hubble/issues/events{/number}","events_url":"https://api.github.com/repos/hubblestack/hubble/events","assignees_url":"https://api.github.com/repos/hubblestack/hubble/assignees{/user}","branches_url":"https://api.github.com/repos/hubblestack/hubble/branches{/branch}","tags_url":"https://api.github.com/repos/hubblestack/hubble/tags","blobs_url":"https://api.github.com/repos/hubblestack/hubble/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hubblestack/hubble/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hubblestack/hubble/git/refs{/sha}","trees_url":"https://api.github.com/repos/hubblestack/hubble/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hubblestack/hubble/statuses/{sha}","languages_url":"https://api.github.com/repos/hubblestack/hubble/languages","stargazers_url":"https://api.github.com/repos/hubblestack/hubble/stargazers","contributors_url":"https://api.github.com/repos/hubblestack/hubble/contributors","subscribers_url":"https://api.github.com/repos/hubblestack/hubble/subscribers","subscription_url":"https://api.github.com/repos/hubblestack/hubble/subscription","commits_url":"https://api.github.com/repos/hubblestack/hubble/commits{/sha}","git_commits_url":"https://api.github.com/repos/hubblestack/hubble/git/commits{/sha}","comments_url":"https://api.github.com/repos/hubblestack/hubble/comments{/number}","issue_comment_url":"https://api.github.com/repos/hubblestack/hubble/issues/comments{/number}","contents_url":"https://api.github.com/repos/hubblestack/hubble/contents/{+path}","compare_url":"https://api.github.com/repos/hubblestack/hubble/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hubblestack/hubble/merges","archive_url":"https://api.github.com/repos/hubblestack/hubble/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hubblestack/hubble/downloads","issues_url":"https://api.github.com/repos/hubblestack/hubble/issues{/number}","pulls_url":"https://api.github.com/repos/hubblestack/hubble/pulls{/number}","milestones_url":"https://api.github.com/repos/hubblestack/hubble/milestones{/number}","notifications_url":"https://api.github.com/repos/hubblestack/hubble/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hubblestack/hubble/labels{/name}","releases_url":"https://api.github.com/repos/hubblestack/hubble/releases{/id}","deployments_url":"https://api.github.com/repos/hubblestack/hubble/deployments","created_at":"2017-01-05T22:05:37Z","updated_at":"2018-03-26T15:59:14Z","pushed_at":"2018-03-26T23:12:18Z","git_url":"git://github.com/hubblestack/hubble.git","ssh_url":"git@github.com:hubblestack/hubble.git","clone_url":"https://github.com/hubblestack/hubble.git","svn_url":"https://github.com/hubblestack/hubble","homepage":"https://hubblestack.io","size":1288,"stargazers_count":71,"watchers_count":71,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":30,"mirror_url":null,"archived":false,"open_issues_count":64,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":30,"open_issues":64,"watchers":71,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/hubblestack/hubble/pulls/317"},"html":{"href":"https://github.com/hubblestack/hubble/pull/317"},"issue":{"href":"https://api.github.com/repos/hubblestack/hubble/issues/317"},"comments":{"href":"https://api.github.com/repos/hubblestack/hubble/issues/317/comments"},"review_comments":{"href":"https://api.github.com/repos/hubblestack/hubble/pulls/317/comments"},"review_comment":{"href":"https://api.github.com/repos/hubblestack/hubble/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hubblestack/hubble/pulls/317/commits"},"statuses":{"href":"https://api.github.com/repos/hubblestack/hubble/statuses/c052ec2ebb2672d613890263c88af73079645fdc"}},"author_association":"OWNER"}}
{"actor":{"display_login":"basepi"}}