Skip to content

Instantly share code, notes, and snippets.

@naokij
Created February 20, 2012 09:21
Show Gist options
  • Save naokij/1868537 to your computer and use it in GitHub Desktop.
Save naokij/1868537 to your computer and use it in GitHub Desktop.
ruby script to create rsyslog discarding terms based on graylog2 blacklist terms
require 'rubygems'
require 'mongo'
@conn = Mongo::Connection.new
@db = @conn['graylog2']
@db.authenticate('grayloguser','grayloguser-mongo-passwd')
@coll = @db['blacklists']
@conf_file = '/etc/rsyslog_disgarding.conf'
@conf_content = ""
@file = File.open(@conf_file,'r')
@conf_content = @file.read
@file.close
@new_config = ''
@coll.find.each do |b|
b['blacklisted_terms'].find.each do |t|
@new_config = @new_config + ":msg, contains, \"#{t['term']}\" ~\n"
end
end
if @conf_content != @new_config
@file = File.open(@conf_file,'w')
@file.write(@new_config)
@file.close
system '/etc/init.d/rsyslogforwarder restart'
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment