logs

Documentation

Index

• Variables
• func GetApparmorLogs(file io.Reader, profile string) []string
• func GetAuditLogs(path string) (io.Reader, error)
• func GetJournalctlLogs(path string, useFile bool) (io.Reader, error)
• func SelectLogFile(path string) string
• type AppArmorLog
• type AppArmorLogs
  • func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs
  • func (aaLogs AppArmorLogs) ParseToProfiles() map[string]*aa.Profile
  • func (aaLogs AppArmorLogs) String() string

Variables

var LogFiles = []string{
	"/var/log/audit/audit.log",
	"/var/log/syslog",
}

LogFiles is the list of default path to query

Functions

func GetApparmorLogs

func GetApparmorLogs(file io.Reader, profile string) []string

GetApparmorLogs return a list of cleaned apparmor logs from a file

func GetAuditLogs

func GetAuditLogs(path string) (io.Reader, error)

GetAuditLogs return a reader with the logs entries from Auditd

func GetJournalctlLogs

func GetJournalctlLogs(path string, useFile bool) (io.Reader, error)

GetJournalctlLogs return a reader with the logs entries from Systemd

func SelectLogFile

func SelectLogFile(path string) string

SelectLogFile return the path of the available log file to parse (audit, syslog, .1, .2)

Types

type AppArmorLog

type AppArmorLog map[string]string

type AppArmorLogs

type AppArmorLogs []AppArmorLog

AppArmorLogs describes all apparmor log entries

func NewApparmorLogs

func NewApparmorLogs(file io.Reader, profile string) AppArmorLogs

NewApparmorLogs return a new ApparmorLogs list of map from a log file

func (AppArmorLogs) ParseToProfiles

func (aaLogs AppArmorLogs) ParseToProfiles() map[string]*aa.Profile

ParseToProfiles convert the log data into a new AppArmorProfiles

func (AppArmorLogs) String

func (aaLogs AppArmorLogs) String() string

String returns a formatted AppArmor logs string