README
¶
Gitlab Log Streamer
Gitlab Log Streamer is a tool designed to overcome the limitations of Gitlab's audit_log.json and potentially other logs.
By default, Gitlab writes its audit events to the audit_log.json file, which limits their usefulness as they stay in your GItLab server filesystem.
This project parses the log file, stores the events in a SQLite database, and allows forwarding of new log entries using syslog format (RFC5424) or IBM QRadar's proprietary LEEF. It also supports defining an HTTP endpoint for POST requests with the event, enabling triggers and actions similar to Gitlab System hooks.
Table of Contents
Installation
Just head to https://github.com/juanfont/gitlab-log-streamer/releases and grab the latest version.
Then place it in your PATH (e.g., /usr/local/bin)
Usage
You need to create a file named config.yaml in the same directory as the binary or in /etc/gitlab-log-streamer:
---
db_path: "streamer.sqlite"
gitlab_hostname: "gitlab.font.eu"
sources:
audit_log_path: "/var/log/gitlab/gitlab-rails/audit_json.log"
destinations:
http:
url: "http://localhost:8080"
headers:
Authorization: "Bearer 1234567890"
Content-Type: "application/json"
syslog:
server_addr: "localhost:1489"
protocol: "udp"
# Optional. If true, the syslog message will be in LEEF format. Otherwise, syslog in RFC5424 format.
use_leef: false
And then just execute:
gitlab-log-streamer watch
Documentation
¶
Index ¶
Constants ¶
const ( AuditEventLoginWithTwoFactor = "two-factor" AuditEventLoginWithU2F = "two-factor-via-u2f-device" AuditEventLoginWithWebAuthn = "two-factor-via-webauthn-device" AuditEventLoginStandard = "standard" )
const (
GitlabVersionManifestPath = "/opt/gitlab/version-manifest.txt"
)
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuditEvent ¶
type AuditEvent struct {
ID uint64 `gorm:"primary_key" json:"-"`
CorrelationID string `gorm:"type:varchar(64);unique_index" json:"correlation_id"`
Severity string `json:"severity"`
Time time.Time `json:"time"`
AuthorID int64 `json:"author_id"`
AuthorName string `json:"author_name"`
EntityID int64 `json:"entity_id"`
EntityType AuthorClass `json:"entity_type"`
CreatedAt time.Time `json:"created_at"`
IPAddress string `json:"ip_address"`
With *With `json:"with,omitempty"`
TargetID *int64 `json:"target_id"`
TargetType AuthorClass `json:"target_type"`
TargetDetails *string `json:"target_details"`
EntityPath string `json:"entity_path"`
Remove *Add `json:"remove,omitempty"`
Add *Add `json:"add,omitempty"`
// Details *Details `json:"details,omitempty"`
// PushAccessLevels []MergeAccessLevelElement `json:"push_access_levels,omitempty"`
// MergeAccessLevels []MergeAccessLevelElement `json:"merge_access_levels,omitempty"`
AllowForcePush *bool `json:"allow_force_push,omitempty"`
CodeOwnerApprovalRequired *bool `json:"code_owner_approval_required,omitempty"`
AuthorClass *AuthorClass `json:"author_class,omitempty"`
CustomMessage *string `json:"custom_message,omitempty"`
As *As `json:"as,omitempty"`
MemberID *int64 `json:"member_id,omitempty"`
Change *Change `json:"change,omitempty"`
From *string `json:"from,omitempty"`
To *string `json:"to,omitempty"`
Action *string `json:"action,omitempty"`
ExpiryFrom *string `json:"expiry_from"`
ExpiryTo *string `json:"expiry_to"`
MetaCallerID string `json:"meta.caller_id"`
MetaRemoteIP string `json:"meta.remote_ip"`
MetaFeatureCategory string `json:"meta.feature_category"`
MetaClientID string `json:"meta.client_id"`
MetaUser string `json:"meta.user,omitempty"`
MetaUserID int `json:"meta.user_id,omitempty"`
OriginalData datatypes.JSON
}
type AuditLogStreamer ¶
type AuditLogStreamer struct {
// contains filtered or unexported fields
}
func NewAuditLogStreamer ¶
func NewAuditLogStreamer(config Config) (*AuditLogStreamer, error)
func (*AuditLogStreamer) Watch ¶
func (s *AuditLogStreamer) Watch() error
type AuthorClass ¶
type AuthorClass string
const ( AuthorClassCiGroupVariable AuthorClass = "Ci::GroupVariable" AuthorClassEmail AuthorClass = "Email" AuthorClassGroup AuthorClass = "Group" AuthorClassProject AuthorClass = "Project" AuthorClassUser AuthorClass = "User" CiRunner AuthorClass = "Ci::Runner" PersonalAccessToken AuthorClass = "PersonalAccessToken" ProtectedBranch AuthorClass = "ProtectedBranch" )
type MergeAccessLevelElement ¶
type MergeAccessLevelElement string
const (
Maintainers MergeAccessLevelElement = "Maintainers"
)
Source Files
Directories