Merge pull request #143 from mdr-engineering/feature/ftd_na_SensuHandlerLogs

Updates Sensu to Use Logfile to Record Events

base/sensu-configuration/checks.tf

@@ -28,7 +28,7 @@ resource "sensu_check" "check_dns_all" {
   command        = "check_dns --hostname=${ each.key } --expected-address=${ each.value } --warning=0.5  --critical=5"
   namespace      = "default"
   subscriptions  = [ "linux", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -40,7 +40,7 @@ resource "sensu_check" "check_dns_private" {
   command        = "check_dns --hostname=${ each.key } --expected-address=${ each.value } --warning=0.5  --critical=5"
   namespace      = "default"
   subscriptions  = [ "private_dns_client", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -51,7 +51,7 @@ resource "sensu_check" "check_disk_base" {
   command        = "check_disk -c 250 -p /var -C -c 500 -p /var/log -C -c 1000 -p /var/log/audit -C -c 2000 -p /opt -C -c 500 -p /boot -C -c 1000 -p /"
   namespace      = "default"
   subscriptions  = [ "linux", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -62,7 +62,7 @@ resource "sensu_check" "check_disk_indexer" {
   command        = "check_disk -c ${local.splunk_hot} -p /opt/splunkdata/hot -C -c 5000 -p /opt/splunk"
   namespace      = "default"
   subscriptions  = [ "check_disk_indexer", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -73,7 +73,7 @@ resource "sensu_check" "check_disk_syslog" {
   command        = "check_disk -c 7000 -p /opt/syslog-ng"
   namespace      = "default"
   subscriptions  = [ "check_disk_syslog", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -85,7 +85,7 @@ resource "sensu_check" "check_ping_interconnect-0" {
   command        = "check_ping -H ${each.value} -w 500,80% -c 500,80% -4"
   namespace      = "default"
   subscriptions  = [ "interconnect-0", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -97,7 +97,7 @@ resource "sensu_check" "check_ping_interconnect-1" {
   command        = "check_ping -H ${each.value} -w 500,80% -c 500,80% -4"
   namespace      = "default"
   subscriptions  = [ "interconnect-1", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-monitoring", ]
@@ -108,7 +108,7 @@ resource "sensu_check" "check_phantom_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 443"
   namespace      = "default"
   subscriptions  = [ "phantom_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -121,7 +121,7 @@ resource "sensu_check" "check_portal_http" {
   command        = "metrics-curl.rb -u https://portal.xdr.accenturefederalcyber.com"
   namespace      = "default"
   subscriptions  = [ "portal", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-http", "sensu-ruby-runtime", ]
@@ -132,7 +132,7 @@ resource "sensu_check" "check_salt_master_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 4505,4506"
   namespace      = "default"
   subscriptions  = [ "salt_master_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -143,7 +143,7 @@ resource "sensu_check" "check_splunk_cm_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089"
   namespace      = "default"
   subscriptions  = [ "splunk_cm_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -154,7 +154,7 @@ resource "sensu_check" "check_splunk_ds_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089"
   namespace      = "default"
   subscriptions  = [ "splunk_ds_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -165,7 +165,7 @@ resource "sensu_check" "check_splunk_hf_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089,8000"
   namespace      = "default"
   subscriptions  = [ "splunk_hf_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -176,7 +176,7 @@ resource "sensu_check" "check_splunk_indexer_ports_moose" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089,9998,9887,8088"
   namespace      = "default"
   subscriptions  = [ "splunk_indexer_ports_moose", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -187,7 +187,7 @@ resource "sensu_check" "check_splunk_indexer_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089,9998,9887"
   namespace      = "default"
   subscriptions  = [ "splunk_indexer_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -198,7 +198,7 @@ resource "sensu_check" "check_splunk_sh_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089,8000"
   namespace      = "default"
   subscriptions  = [ "splunk_sh_ports", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -209,7 +209,7 @@ resource "sensu_check" "check_splunk_uf_ports" {
   command        = "check-ports.rb -h 0.0.0.0 -p 8089"
   namespace      = "default"
   subscriptions  = [ "splunk", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-network-checks", "sensu-ruby-runtime", ]
@@ -220,7 +220,7 @@ resource "sensu_check" "check_syslog-ng_service" {
   command        = "check-process.rb -p syslog-ng"
   namespace      = "default"
   subscriptions  = [ "syslog-ng_service", ]
-  handlers       = [ "victorops", "splunk", ]
+  handlers       = [ "victorops", "logfile", ]
   cron           = "* * * * *"
   publish        = "true"
   runtime_assets = [ "sensu-plugins-process-checks", "sensu-ruby-runtime", ]

base/sensu-configuration/handlers.tf

@@ -19,12 +19,12 @@ resource "sensu_handler" "handler_victorops" {
   command        = "handler-victorops.rb --map_go_event_into_ruby -a https://alert.victorops.com/integrations/generic/20131114/alert/864a1b38-4243-4137-8baa-b587ba5f300b/ -r ${local.victorops_team}"
 }
 
-resource "sensu_handler" "handler_splunk" {
-  name           = "splunk"
+resource "sensu_handler" "handler_logfile" {
+  name           = "logfile"
   type           = "pipe"
   namespace      = "default"
-  handlers       = [ "splunk", ]
+  handlers       = [ ]
   filters        = [ ]
   runtime_assets = [ "sensu-ruby-runtime", ]
-  command        = "/usr/local/bin/stdin_to_hec.py"
+  command        = "/usr/local/bin/stdin_to_log.py"
 }