file

Documentation

Index

• Constants
• func New(base mb.BaseMetricSet) (mb.MetricSet, error)
• type Action
  • func (a Action) String() string
• type Config
  • func (c *Config) Validate() error
• type Event
  • func NewEvent(path string, action Action, source Source, maxFileSize uint64, ...) Event
  • func NewEventFromFileInfo(path string, info os.FileInfo, err error, action Action, source Source, ...) Event
  • func (e *Event) String() string
• type EventProducer
  • func NewEventReader(c Config) (EventProducer, error)
  • func NewFileSystemScanner(c Config) (EventProducer, error)
• type HashType
  • func (t *HashType) Unpack(v string) error
• type Metadata
  • func NewMetadata(path string, info os.FileInfo) (*Metadata, error)
• type MetricSet
  • func (ms *MetricSet) Close() error
  • func (ms *MetricSet) Run(reporter mb.PushReporter)
• type Source
  • func (s Source) String() string
• type Type
  • func (t Type) String() string

Constants

const (
	None = iota << 1
	AttributesModified
	Created
	Deleted
	Updated
	Moved
	ConfigChange
)

List of possible Actions.

Functions

func New

func New(base mb.BaseMetricSet) (mb.MetricSet, error)

New returns a new file.MetricSet.

Types

type Action

type Action uint8

Action is a description of the change that occurred.

func (Action) String

func (a Action) String() string

type Config

type Config struct {
	Paths               []string   `config:"file.paths" validate:"required"`
	HashTypes           []HashType `config:"file.hash_types"`
	MaxFileSize         string     `config:"file.max_file_size"`
	MaxFileSizeBytes    uint64     `config:",ignore"`
	ScanAtStart         bool       `config:"file.scan_at_start"`
	ScanRatePerSec      string     `config:"file.scan_rate_per_sec"`
	ScanRateBytesPerSec uint64     `config:",ignore"`

	// Recursive enables recursive monitoring of directories.
	// XXX: This feature is only implemented in the scanner. It needs to be
	// implemented in the fsnotify code. Don't use it yet.
	Recursive bool `config:"file.recursive"`
}

Config contains the configuration parameters for the file integrity metricset.

func (*Config) Validate

func (c *Config) Validate() error

Validate validates the config data and return an error explaining all the problems with the config. This method modifies the given config.

type Event

type Event struct {
	Timestamp  time.Time           // Time of event.
	Path       string              // The path associated with the event.
	TargetPath string              // Target path for symlinks.
	Info       *Metadata           // File metadata (if the file exists).
	Source     Source              // Source of the event.
	Action     Action              // Action (like created, updated).
	Hashes     map[HashType][]byte // File hashes.
	// contains filtered or unexported fields
}

Event describe the filesystem change and includes metadata about the file.

func NewEvent

func NewEvent(
	path string,
	action Action,
	source Source,
	maxFileSize uint64,
	hashTypes []HashType,
) Event

NewEvent creates a new Event. Any errors that occur are included in the returned Event.

func NewEventFromFileInfo

func NewEventFromFileInfo(
	path string,
	info os.FileInfo,
	err error,
	action Action,
	source Source,
	maxFileSize uint64,
	hashTypes []HashType,
) Event

NewEventFromFileInfo creates a new Event based on data from a os.FileInfo object that has already been created. Any errors that occur are included in the returned Event.

func (*Event) String

func (e *Event) String() string

type EventProducer

type EventProducer interface {
	// Start starts the event producer and writes events to the returned
	// channel. When the producer is finished it will close the returned
	// channel. If the returned event channel is not drained the producer will
	// block (possibly causing data loss). The producer can be stopped
	// prematurely by closing the provided done channel. An error is returned
	// if the producer fails to start.
	Start(done <-chan struct{}) (<-chan Event, error)
}

EventProducer produces events.

func NewEventReader

func NewEventReader(c Config) (EventProducer, error)

NewEventReader creates a new EventProducer backed by fsnotify.

func NewFileSystemScanner

func NewFileSystemScanner(c Config) (EventProducer, error)

NewFileSystemScanner creates a new EventProducer instance that scans the configured file paths.

type HashType

type HashType string

HashType identifies a cryptographic algorithm.

const (
	MD5        HashType = "md5"
	SHA1       HashType = "sha1"
	SHA224     HashType = "sha224"
	SHA256     HashType = "sha256"
	SHA384     HashType = "sha384"
	SHA3_224   HashType = "sha3_224"
	SHA3_256   HashType = "sha3_256"
	SHA3_384   HashType = "sha3_384"
	SHA3_512   HashType = "sha3_512"
	SHA512     HashType = "sha512"
	SHA512_224 HashType = "sha512_224"
	SHA512_256 HashType = "sha512_256"
)

Enum of hash types.

func (*HashType) Unpack

func (t *HashType) Unpack(v string) error

Unpack unpacks a string to a HashType for config parsing.

type Metadata

type Metadata struct {
	Inode uint64
	UID   uint32
	GID   uint32
	SID   string
	Owner string
	Group string
	Size  uint64
	MTime time.Time   // Last modification time.
	CTime time.Time   // Last metdata change time.
	Type  Type        // File type (dir, file, symlink).
	Mode  os.FileMode // Permissions
}

Metadata contains file metadata.

func NewMetadata

func NewMetadata(path string, info os.FileInfo) (*Metadata, error)

NewMetadata returns a new Metadata object. If an error is returned it is still possible for a non-nil Metadata object to be returned (possibly with less data populated).

type MetricSet

type MetricSet struct {
	mb.BaseMetricSet
	// contains filtered or unexported fields
}

MetricSet for monitoring file integrity.

func (*MetricSet) Close

func (ms *MetricSet) Close() error

Close cleans up the MetricSet when it finishes.

func (*MetricSet) Run

func (ms *MetricSet) Run(reporter mb.PushReporter)

Run runs the MetricSet. The method will not return control to the caller until it is finished (to stop it close the reporter.Done() channel).

type Source

type Source uint8

Source identifies the source of an event (i.e. what triggered it).

const (
	// SourceScan identifies events triggerd by a file system scan.
	SourceScan Source = iota
	// SourceFSNotify identifies events triggered by a notification from the
	// file system.
	SourceFSNotify
)

func (Source) String

func (s Source) String() string

type Type

type Type uint8

Type identifies the file type (e.g. dir, file, symlink).

const (
	UnknownType Type = iota // Typically seen in deleted notifications where the object is gone.
	FileType
	DirType
	SymlinkType
)

Enum of possible file.Types.

func (Type) String

func (t Type) String() string