logger

Documentation

Overview

Package logger creates an osquery logging plugin.

See https://osquery.readthedocs.io/en/latest/development/logger-plugins/ for more.

Index

• type LogFunc
• type LogType
  • func (l LogType) String() string
• type Plugin
  • func NewPlugin(name string, fn LogFunc) *Plugin
  • func (t *Plugin) Call(ctx context.Context, request osquery.ExtensionPluginRequest) osquery.ExtensionResponse
  • func (t *Plugin) Name() string
  • func (t *Plugin) Ping() osquery.ExtensionStatus
  • func (t *Plugin) RegistryName() string
  • func (t *Plugin) Routes() osquery.ExtensionPluginResponse
  • func (t *Plugin) Shutdown()

Types

type LogFunc

type LogFunc func(ctx context.Context, typ LogType, log string) error

LogFunc is the logger function used by an osquery Logger plugin.

The LogFunc should log the provided result string. The LogType argument can be optionally used to log differently depending on the type of log received. The context argument can optionally be used for cancellation in long-running operations.

type LogType

type LogType int

LogType encodes the type of log osquery is outputting.

const (
	LogTypeString LogType = iota
	LogTypeSnapshot
	LogTypeHealth
	LogTypeInit
	LogTypeStatus
)

func (LogType) String

func (l LogType) String() string

String implements the fmt.Stringer interface for LogType.

type Plugin

type Plugin struct {
	// contains filtered or unexported fields
}

Plugin is an osquery logger plugin. The Plugin struct implements the OsqueryPlugin interface.

func NewPlugin

func NewPlugin(name string, fn LogFunc) *Plugin

NewPlugin takes a value that implements LoggerPlugin and wraps it with the appropriate methods to satisfy the OsqueryPlugin interface. Use this to easily create plugins implementing osquery loggers.

func (*Plugin) Call

func (t *Plugin) Call(ctx context.Context, request osquery.ExtensionPluginRequest) osquery.ExtensionResponse

func (*Plugin) Name

func (t *Plugin) Name() string

func (*Plugin) Ping

func (t *Plugin) Ping() osquery.ExtensionStatus

func (*Plugin) RegistryName

func (t *Plugin) RegistryName() string

func (*Plugin) Routes

func (t *Plugin) Routes() osquery.ExtensionPluginResponse

func (*Plugin) Shutdown

func (t *Plugin) Shutdown()