hostobserver

README

Host Observer Extension

Status: beta

The host_observer looks at the current host for listening network endpoints.

It will look for all listening sockets on TCP and UDP over IPv4 and IPv6.

It uses the /proc filesystem and requires the SYS_PTRACE and DAC_READ_SEARCH capabilities so that it can determine what processes own the listening sockets.

Configuration

refresh_interval

Determines how often to look for changes in endpoints.

default: 10s

Endpoint Variables

Endpoint variables exposed by this observer are as follows.

Variable	Description
type	"port"
name	name of the process associated to the port
port	port number
command	full command used to invoke this process, including the executable itself at the beginning
is_ipv6	true if the endpoint is IPv6
transport	"TCP" or "UDP"

Documentation

Index

• func NewFactory() component.ExtensionFactory
• type Config

Functions

func NewFactory

func NewFactory() component.ExtensionFactory

NewFactory creates a factory for HostObserver extension.

Types

type Config

type Config struct {
	config.ExtensionSettings `mapstructure:",squash"`

	// RefreshInterval determines how frequency at which the observer
	// needs to poll for collecting information about new processes.
	RefreshInterval time.Duration `mapstructure:"refresh_interval"`
}

Config defines configuration for host observer.