diff --git a/minimal.py b/minimal.py index 9c2c849..f6a9479 100644 --- a/minimal.py +++ b/minimal.py @@ -25,15 +25,18 @@ def __init__(self): def run(self): - evefile = open('/var/log/suricata/eve.json', 'r', encoding='utf-8') + open_evefile = lambda: open('/var/log/suricata/eve.json', 'r', encoding='utf-8') + start_inotifier = lambda path: inotify.adapters.Inotify(paths=[path]) + + evefile = open_evefile() evefile.seek(0, os.SEEK_END) - inotifier = inotify.adapters.Inotify(paths=[evefile.name]) + inotifier = start_inotifier(evefile.name) stats = collections.defaultdict(int) last = time.time() while not self.stop: - reopen = False + reopen, restart = False, False for event in inotifier.event_gen(timeout_s=1): if event is None: continue @@ -73,15 +76,22 @@ def run(self): break - elif t == 'IN_CLOSE_WRITE': + elif t in ['IN_CLOSE_WRITE', 'IN_DELETE_SELF', 'IN_MOVE_SELF', 'IN_IGNORED']: reopen = True + if t == 'IN_IGNORED': + restart = True if reopen: logging.info('detected file write (eg log rotation), reopening file') + evefile.close() - evefile = open('/var/log/suricata/eve.json', 'r', encoding='utf-8') + evefile = open_evefile() stats['reopens'] += 1 + if restart: + inotifier = start_inotifier(evefile.name) + stats['restarts'] += 1 + if len(stats) > 0 and time.time() - last >= 3600: logging.info('stats: %s', ', '.join(['%s = %d' % (k, stats[k]) for k in sorted(stats.keys())])) stats = collections.defaultdict(int)