2014-04-14 15:26:48 +01:00
|
|
|
{ config, lib, pkgs, ... }:
|
2012-08-25 10:11:37 +01:00
|
|
|
|
2014-04-14 15:26:48 +01:00
|
|
|
with lib;
|
2012-08-25 10:11:37 +01:00
|
|
|
|
|
|
|
let
|
|
|
|
cfg = config.services.logcheck;
|
|
|
|
|
2018-11-08 10:59:03 +00:00
|
|
|
defaultRules = pkgs.runCommand "logcheck-default-rules" { preferLocalBuild = true; } ''
|
2012-10-08 15:00:05 +01:00
|
|
|
cp -prd ${pkgs.logcheck}/etc/logcheck $out
|
|
|
|
chmod u+w $out
|
2017-12-11 10:33:13 +00:00
|
|
|
rm -r $out/logcheck.*
|
2012-10-08 15:00:05 +01:00
|
|
|
'';
|
|
|
|
|
2016-04-26 13:10:42 +01:00
|
|
|
rulesDir = pkgs.symlinkJoin
|
|
|
|
{ name = "logcheck-rules-dir";
|
|
|
|
paths = ([ defaultRules ] ++ cfg.extraRulesDirs);
|
|
|
|
};
|
2012-08-25 10:11:37 +01:00
|
|
|
|
|
|
|
configFile = pkgs.writeText "logcheck.conf" cfg.config;
|
|
|
|
|
|
|
|
logFiles = pkgs.writeText "logcheck.logfiles" cfg.files;
|
|
|
|
|
|
|
|
flags = "-r ${rulesDir} -c ${configFile} -L ${logFiles} -${levelFlag} -m ${cfg.mailTo}";
|
|
|
|
|
|
|
|
levelFlag = getAttrFromPath [cfg.level]
|
2019-08-13 22:52:01 +01:00
|
|
|
{ paranoid = "p";
|
|
|
|
server = "s";
|
|
|
|
workstation = "w";
|
2012-08-25 10:11:37 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
cronJob = ''
|
2017-01-29 10:11:01 +00:00
|
|
|
@reboot logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck -R ${flags}
|
|
|
|
2 ${cfg.timeOfDay} * * * logcheck env PATH=/run/wrappers/bin:$PATH nice -n10 ${pkgs.logcheck}/sbin/logcheck ${flags}
|
2012-08-25 10:11:37 +01:00
|
|
|
'';
|
|
|
|
|
2012-10-08 15:00:05 +01:00
|
|
|
writeIgnoreRule = name: {level, regex, ...}:
|
|
|
|
pkgs.writeTextFile
|
|
|
|
{ inherit name;
|
|
|
|
destination = "/ignore.d.${level}/${name}";
|
|
|
|
text = ''
|
|
|
|
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ ${regex}
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
writeIgnoreCronRule = name: {level, user, regex, cmdline, ...}:
|
|
|
|
let escapeRegex = escape (stringToCharacters "\\[]{}()^$?*+|.");
|
|
|
|
cmdline_ = builtins.unsafeDiscardStringContext cmdline;
|
|
|
|
re = if regex != "" then regex else if cmdline_ == "" then ".*" else escapeRegex cmdline_;
|
|
|
|
in writeIgnoreRule "cron-${name}" {
|
|
|
|
inherit level;
|
|
|
|
regex = ''
|
|
|
|
(/usr/bin/)?cron\[[0-9]+\]: \(${user}\) CMD \(${re}\)$
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
levelOption = mkOption {
|
|
|
|
default = "server";
|
2016-11-04 04:11:37 +00:00
|
|
|
type = types.enum [ "workstation" "server" "paranoid" ];
|
2012-10-08 15:00:05 +01:00
|
|
|
description = ''
|
2016-11-04 04:11:37 +00:00
|
|
|
Set the logcheck level.
|
2012-10-08 15:00:05 +01:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
ignoreOptions = {
|
2016-09-11 08:46:00 +01:00
|
|
|
options = {
|
|
|
|
level = levelOption;
|
2012-10-08 15:00:05 +01:00
|
|
|
|
2016-09-11 08:46:00 +01:00
|
|
|
regex = mkOption {
|
|
|
|
default = "";
|
|
|
|
type = types.str;
|
|
|
|
description = ''
|
|
|
|
Regex specifying which log lines to ignore.
|
|
|
|
'';
|
|
|
|
};
|
2012-10-08 15:00:05 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
ignoreCronOptions = {
|
2016-09-11 08:46:00 +01:00
|
|
|
options = {
|
|
|
|
user = mkOption {
|
|
|
|
default = "root";
|
|
|
|
type = types.str;
|
|
|
|
description = ''
|
|
|
|
User that runs the cronjob.
|
|
|
|
'';
|
|
|
|
};
|
2012-10-08 15:00:05 +01:00
|
|
|
|
2016-09-11 08:46:00 +01:00
|
|
|
cmdline = mkOption {
|
|
|
|
default = "";
|
|
|
|
type = types.str;
|
|
|
|
description = ''
|
|
|
|
Command line for the cron job. Will be turned into a regex for the logcheck ignore rule.
|
|
|
|
'';
|
|
|
|
};
|
2012-10-08 15:00:05 +01:00
|
|
|
|
2016-09-11 08:46:00 +01:00
|
|
|
timeArgs = mkOption {
|
|
|
|
default = null;
|
|
|
|
type = types.nullOr (types.str);
|
|
|
|
example = "02 06 * * *";
|
|
|
|
description = ''
|
|
|
|
"min hr dom mon dow" crontab time args, to auto-create a cronjob too.
|
|
|
|
Leave at null to not do this and just add a logcheck ignore rule.
|
|
|
|
'';
|
|
|
|
};
|
2012-10-08 15:00:05 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2012-08-25 10:11:37 +01:00
|
|
|
in
|
|
|
|
{
|
|
|
|
options = {
|
|
|
|
services.logcheck = {
|
|
|
|
enable = mkOption {
|
|
|
|
default = false;
|
|
|
|
type = types.bool;
|
|
|
|
description = ''
|
|
|
|
Enable the logcheck cron job.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
user = mkOption {
|
|
|
|
default = "logcheck";
|
2013-10-30 10:02:04 +00:00
|
|
|
type = types.str;
|
2012-08-25 10:11:37 +01:00
|
|
|
description = ''
|
|
|
|
Username for the logcheck user.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
timeOfDay = mkOption {
|
|
|
|
default = "*";
|
|
|
|
example = "6";
|
2013-10-30 10:02:04 +00:00
|
|
|
type = types.str;
|
2012-08-25 10:11:37 +01:00
|
|
|
description = ''
|
|
|
|
Time of day to run logcheck. A logcheck will be scheduled at xx:02 each day.
|
|
|
|
Leave default (*) to run every hour. Of course when nothing special was logged,
|
|
|
|
logcheck will be silent.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
mailTo = mkOption {
|
|
|
|
default = "root";
|
|
|
|
example = "you@domain.com";
|
2013-10-30 10:02:04 +00:00
|
|
|
type = types.str;
|
2012-08-25 10:11:37 +01:00
|
|
|
description = ''
|
|
|
|
Email address to send reports to.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
level = mkOption {
|
|
|
|
default = "server";
|
2013-10-30 10:02:04 +00:00
|
|
|
type = types.str;
|
2012-08-25 10:11:37 +01:00
|
|
|
description = ''
|
|
|
|
Set the logcheck level. Either "workstation", "server", or "paranoid".
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
config = mkOption {
|
|
|
|
default = "FQDN=1";
|
2019-08-08 21:48:27 +01:00
|
|
|
type = types.lines;
|
2012-08-25 10:11:37 +01:00
|
|
|
description = ''
|
|
|
|
Config options that you would like in logcheck.conf.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
files = mkOption {
|
|
|
|
default = [ "/var/log/messages" ];
|
|
|
|
type = types.listOf types.path;
|
|
|
|
example = [ "/var/log/messages" "/var/log/mail" ];
|
|
|
|
description = ''
|
|
|
|
Which log files to check.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2012-10-08 15:00:05 +01:00
|
|
|
extraRulesDirs = mkOption {
|
|
|
|
default = [];
|
2012-08-25 10:11:37 +01:00
|
|
|
example = "/etc/logcheck";
|
2012-10-08 15:00:05 +01:00
|
|
|
type = types.listOf types.path;
|
2012-08-25 10:11:37 +01:00
|
|
|
description = ''
|
2012-10-08 15:00:05 +01:00
|
|
|
Directories with extra rules.
|
2012-08-25 10:11:37 +01:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2012-10-08 15:00:05 +01:00
|
|
|
ignore = mkOption {
|
|
|
|
default = {};
|
|
|
|
description = ''
|
|
|
|
This option defines extra ignore rules.
|
|
|
|
'';
|
2016-11-16 07:29:58 +00:00
|
|
|
type = with types; attrsOf (submodule ignoreOptions);
|
2012-10-08 15:00:05 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
ignoreCron = mkOption {
|
|
|
|
default = {};
|
|
|
|
description = ''
|
|
|
|
This option defines extra ignore rules for cronjobs.
|
|
|
|
'';
|
2016-11-16 07:29:58 +00:00
|
|
|
type = with types; attrsOf (submodule ignoreCronOptions);
|
2012-10-08 15:00:05 +01:00
|
|
|
};
|
|
|
|
|
2012-08-25 10:11:37 +01:00
|
|
|
extraGroups = mkOption {
|
|
|
|
default = [];
|
2015-06-15 17:18:46 +01:00
|
|
|
type = types.listOf types.str;
|
2012-08-25 10:11:37 +01:00
|
|
|
example = [ "postdrop" "mongodb" ];
|
|
|
|
description = ''
|
|
|
|
Extra groups for the logcheck user, for example to be able to use sendmail,
|
|
|
|
or to access certain log files.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
2012-10-08 15:00:05 +01:00
|
|
|
services.logcheck.extraRulesDirs =
|
|
|
|
mapAttrsToList writeIgnoreRule cfg.ignore
|
|
|
|
++ mapAttrsToList writeIgnoreCronRule cfg.ignoreCron;
|
|
|
|
|
2019-09-14 18:51:29 +01:00
|
|
|
users.users = optionalAttrs (cfg.user == "logcheck") {
|
|
|
|
logcheck = {
|
2014-02-11 13:19:06 +00:00
|
|
|
uid = config.ids.uids.logcheck;
|
2012-08-25 10:11:37 +01:00
|
|
|
shell = "/bin/sh";
|
|
|
|
description = "Logcheck user account";
|
|
|
|
extraGroups = cfg.extraGroups;
|
2019-09-14 18:51:29 +01:00
|
|
|
};
|
|
|
|
};
|
2012-08-25 10:11:37 +01:00
|
|
|
|
|
|
|
system.activationScripts.logcheck = ''
|
|
|
|
mkdir -m 700 -p /var/{lib,lock}/logcheck
|
|
|
|
chown ${cfg.user} /var/{lib,lock}/logcheck
|
|
|
|
'';
|
|
|
|
|
2012-10-08 15:00:05 +01:00
|
|
|
services.cron.systemCronJobs =
|
2019-04-24 04:48:22 +01:00
|
|
|
let withTime = name: {timeArgs, ...}: timeArgs != null;
|
2012-10-08 15:00:05 +01:00
|
|
|
mkCron = name: {user, cmdline, timeArgs, ...}: ''
|
|
|
|
${timeArgs} ${user} ${cmdline}
|
|
|
|
'';
|
|
|
|
in mapAttrsToList mkCron (filterAttrs withTime cfg.ignoreCron)
|
|
|
|
++ [ cronJob ];
|
2012-08-25 10:11:37 +01:00
|
|
|
};
|
|
|
|
}
|