fluent-plugin-utmpx
Fluentd input plugin to extract /var/log/wtmp or /var/run/utmp.
This plugin uses linux-utmpx to parse above files.
Installation
RubyGems
$ gem install fluent-plugin-utmpx
Bundler
Add following line to your Gemfile:
gem "fluent-plugin-utmpx"
And then execute:
$ bundle
Configuration
Fluent::Plugin::UtmpxInput
| parameter | type | description | default |
|---|---|---|---|
| path | string (required) | Path to wtmp,utmp | |
| tag | string (required) | Tag string | |
| interval | integer (optional) | Interval to check path (N seconds) |
10 |
| pos_file | string (required) | Record the position it last read into this file |
The extracted record contains:
| field | type | description |
|---|---|---|
| type | string | Type of login. It must be either EMPTY, RUN_LVL, BOOT_TIME, NEW_TIME, OLD_TIME, INIT_PROCESS, LOGIN_PROCESS, USER_PROCESS, DEAD_PROCESS or ACCOUNTING. |
| pid | integer | Process ID |
| line | string | Device name (e.g. pts/N) |
| user | string | Username |
| host | string | Hostname for remote login |
Usage
Here is the example to use utmpx input plugin.
<source>
@type utmpx
tag wtmp
pos_file wtmp.pos
path /var/log/wtmp
</source>
<match **>
@type stdout
</match>
Then you can retrieve these events.
2021-03-05 09:03:42.629627000 +0900 wtmp: {"user":"kenhys","type":"RUN_LVL","pid":53,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:03:46.521452000 +0900 wtmp: {"user":"kenhys","type":"INIT_PROCESS","pid":1673,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:03:46.521452000 +0900 wtmp: {"user":"kenhys","type":"LOGIN_PROCESS","pid":1673,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:03:58.026903000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":3018,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:21.940292000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:22.473919000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:22.921871000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:23.337814000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:23.753983000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:24.170198000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 20:54:58.325838000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 20:54:58.941467000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 20:54:59.459935000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 20:54:59.923351000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 21:31:43.002278000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 21:31:43.900405000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 21:32:06.755036000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":0,"line":"pts/8","host":"tmux(9528).%4"}
Copyright
- Copyright(c) 2021- Kentaro Hayashi
- License
- Apache License, Version 2.0