Skip to content

Instantly share code, notes, and snippets.

@reyjrar
reyjrar / logstash.conf
Created July 5, 2012 12:48
LogStash Configuration
input {
tcp {
type => "syslog"
port => 8514
}
}
filter {
## DISCARD IMPROPERLY FORMATTED MESSAGES
@reyjrar
reyjrar / errors.log
Last active November 20, 2016 13:32
Sample Queries with es-search.pl
brad@janus $ es-search.pl --top program error
= Querying Indexes: syslog-2016.11.20
count program
487 sshd
33 postfix/smtpd
24 postfix/smtps/smtpd
1 freshclam
# Search Parameters:
# {"bool":{"must":[{"query_string":{"query":"error"}}]}}
# Displaying 4 of 545 in 0 seconds.
@reyjrar
reyjrar / logstash-config-broken.conf - Starting Point
Last active August 4, 2016 18:06
Massive Parse Tree Failure in Logstash 5.0.0-alpha3
input {
udp {
host => "127.0.0.1"
port => 9514
type => "syslog"
}
}
filter {
# This grok FAILS with a PARSE ERROR
grok {
@reyjrar
reyjrar / unbound.pp
Created May 7, 2016 04:12
Puppet class to install unbound and use yoyo.org for blocking ad servers.
# puppet module install zleslie-unbound
class dns::caching {
# I'm using extlookup for a very small personal network, could be hiera
$trusted_ipv4 = extlookup('trusted_ipv4')
$trusted_ipv6 = extlookup('trusted_ipv6')
realize(Group['unbound'])
realize(User['unbound'])
$local_ad_servers = "/etc/unbound/local.d/adservers.conf"

Keybase proof

I hereby claim:

  • I am reyjrar on github.
  • I am reyjrar (https://keybase.io/reyjrar) on keybase.
  • I have a public key ASBhL2F7FpCetTBbHeSajnZusy0pe2QJNTX69go64Lwm_wo

To claim this, I am signing this object:

@reyjrar
reyjrar / es-utils-4.4-release-notes
Created February 27, 2016 07:26
es-utils-4.4-release-notes
==================================================
Changes from 2014-02-27 00:00:00 +0000 to present.
==================================================
----------------------------------------
version 4.4 at 2016-02-27 07:15:06 +0000
----------------------------------------
Change: 4a832f92659ebc575d2de0948dbb01b8e349138b
Author: Brad Lhotsky <blhotsky@craigslist.org>
@reyjrar
reyjrar / digiti-matching.pl
Created December 8, 2013 12:20
Testing variations on matching digits with Perl Regex
#!/usr/bin/env perl
#
use strict;
use warnings;
use Benchmark qw(cmpthese);
my @tests = (
q{testing 12345 some more stuff},
q{123 testing some stuff},
@reyjrar
reyjrar / adobe.txt
Last active December 29, 2015 21:59
Output from a bitsquatting whois tool I'm working on. GOOGLEUSERCONTENT.COM is rated #44 on the Alexa Top Sites
$ ./bin/bit-whois.pl adobe.com
adobe.com variation bdobe.com is taken (ns01.domaincontrol.com)
adobe.com variation aeobe.com is !! ERROR !!
No Match Domain!
adobe.com variation acobe.com is taken (ns1.s416.sureserver.com)
adobe.com variation adpbe.com is taken (ns2.hastydns.com)
adobe.com variation adnbe.com is ** AVAILABLE **
adobe.com variation adoce.com is taken (ns2.warptech.net)
adobe.com variation adoae.com is ** AVAILABLE **
adobe.com variation adobf.com is ** AVAILABLE **
@reyjrar
reyjrar / feature.xml
Created July 9, 2013 12:06
Possible enhancement to the decoders/rules
<decoder name="uptime">
<regex>load avergage: (\S+),</regex>
<order>var:load<order>
</decoder>
<rule id="100000" level="10">
<decoded_as>uptime</decoded_as>
<compare var="load" is="numeric" check="gt">2</compare>
</rule>
@reyjrar
reyjrar / crontab.xml
Created June 26, 2013 15:46
OSSEC Decoder for crontab manipulation.
<!-- Decoder to enable extracting data from the crontab command
Aug 30 17:13:02 server.example.com crontab[1347]: (root) LIST (root)
Aug 30 17:13:38 server.example.com crontab[2852]: (root) BEGIN EDIT (root)
Aug 30 17:13:41 server.example.com crontab[2852]: (root) REPLACE (root)
Aug 30 17:13:41 server.example.com crontab[2852]: (root) END EDIT (root)
Aug 30 17:14:01 server.example.com crond[1756]: (root) RELOAD (/var/spool/cron/root)
Aug 30 17:14:01 server.example.com CROND[4018]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Aug 30 17:14:06 server.example.com crontab[4030]: (root) LIST (root)
Aug 30 17:15:01 server.example.com CROND[5818]: (root) CMD (/usr/lib64/sa/sa1 1 1)