Skip to content

Fluentd Input plugin to extract utmpx entry from /var/log/wtmp,/var/run/utmp.

License

Notifications You must be signed in to change notification settings

fluent-plugins-nursery/fluent-plugin-utmpx

Repository files navigation

fluent-plugin-utmpx

Fluentd input plugin to extract /var/log/wtmp or /var/run/utmp.

This plugin uses linux-utmpx to parse above files.

Installation

RubyGems

$ gem install fluent-plugin-utmpx

Bundler

Add following line to your Gemfile:

gem "fluent-plugin-utmpx"

And then execute:

$ bundle

Configuration

Fluent::Plugin::UtmpxInput

parameter type description default
path string (required) Path to wtmp,utmp
tag string (required) Tag string
interval integer (optional) Interval to check path (N seconds) 10
pos_file string (required) Record the position it last read into this file

The extracted record contains:

field type description
type string Type of login. It must be either EMPTY, RUN_LVL, BOOT_TIME, NEW_TIME, OLD_TIME, INIT_PROCESS, LOGIN_PROCESS, USER_PROCESS, DEAD_PROCESS or ACCOUNTING.
pid integer Process ID
line string Device name (e.g. pts/N)
user string Username
host string Hostname for remote login

Usage

Here is the example to use utmpx input plugin.

<source>
  @type utmpx
  tag wtmp
  pos_file wtmp.pos
  path /var/log/wtmp
</source>

<match **>
  @type stdout
</match>

Then you can retrieve these events.

2021-03-05 09:03:42.629627000 +0900 wtmp: {"user":"kenhys","type":"RUN_LVL","pid":53,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:03:46.521452000 +0900 wtmp: {"user":"kenhys","type":"INIT_PROCESS","pid":1673,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:03:46.521452000 +0900 wtmp: {"user":"kenhys","type":"LOGIN_PROCESS","pid":1673,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:03:58.026903000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":3018,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:21.940292000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:22.473919000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:22.921871000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:23.337814000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:23.753983000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 09:05:24.170198000 +0900 wtmp: {"user":"kenhys","type":"USER_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 20:54:58.325838000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"}
2021-03-05 20:54:58.941467000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"} 
2021-03-05 20:54:59.459935000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"} 
2021-03-05 20:54:59.923351000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"} 
2021-03-05 21:31:43.002278000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"} 
2021-03-05 21:31:43.900405000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":10248,"line":"pts/8","host":"tmux(9528).%4"} 
2021-03-05 21:32:06.755036000 +0900 wtmp: {"user":"kenhys","type":"DEAD_PROCESS","pid":0,"line":"pts/8","host":"tmux(9528).%4"}

Copyright

  • Copyright(c) 2021- Kentaro Hayashi
  • License
    • Apache License, Version 2.0

About

Fluentd Input plugin to extract utmpx entry from /var/log/wtmp,/var/run/utmp.

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages