-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update readme to be much more complete.
- Loading branch information
Showing
3 changed files
with
141 additions
and
52 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,82 +1,168 @@ | ||
|
||
================================================ | ||
Logging to, and input from, PostgreSQL Databases | ||
================================================ | ||
|
||
Introduction and Warning | ||
------------------------ | ||
======================== | ||
|
||
This plugin offers the possibility to log to PostgreSQL databases as | ||
well as to read information from PostgreSQL databases. Note that the | ||
current state of the plugin is still experimental. | ||
This plugin allows logging to as well as reading from PostgreSQL | ||
databases. While the basic functionality seems to work, it has not | ||
seen much real-life testing and no functionality guarantees are made. | ||
This plugin should be considered experimental. | ||
|
||
Installation | ||
------------ | ||
|
||
After installing PostgreSQL, the following command will compile and install | ||
the Bro PostgreSQL module, assuming it can find the headers in a standard | ||
location:: | ||
After installing PostgreSQL, you can install the Bro PostgreSQL module | ||
either using bro-pkg, or manually via the command-line. | ||
|
||
To install the plugin using bro-pkg, use | ||
|
||
```console | ||
# bro-pkg install 0xxon/bro-postgresql | ||
``` | ||
|
||
# ./configure && make && make install | ||
To install manually from the cloned repository, use:: | ||
|
||
```console | ||
# ./configure && make && make install | ||
``` | ||
|
||
If PostgreSQL is installed in a non-standard location, add | ||
``--with-postgresql=<postgresql-base-directory`` to the ``configure`` command. | ||
If everything built and installed correctly, you should see this:: | ||
Use bro -N to verify correct installation: | ||
|
||
```console | ||
# bro -N Johanna::PostgreSQL | ||
Johanna::PostgreSQL - PostgreSQL log writer and input reader (dynamic, version 0.1) | ||
``` | ||
|
||
Logging Data into PostgreSQL databases | ||
------------------------------------- | ||
|
||
The easiest way to add PostgreSQL logging is by adding a logging filter to an | ||
already existing logging stream. This first example also sends the conn.log | ||
to PostgreSQL: | ||
|
||
```bro | ||
event bro_init() | ||
{ | ||
local filter: Log::Filter = [$name="postgres", $path="conn", $writer=Log::WRITER_POSTGRESQL, $config=table(["dbname"]="testdb")]; | ||
Log::add_filter(Conn::LOG, filter); | ||
} | ||
``` | ||
|
||
This will write to a database named testdb into the table named conn. Note that | ||
the table will be automatically be created by the PostgreSQL plugin, if it does | ||
not yet exist. If a table with the specified name already exists, it is used; | ||
the existing columns have to be compatible with the column names and types that | ||
the Bro plugin expects. | ||
|
||
Data can be read from PostgreSQL using a script similar to: | ||
|
||
```bro | ||
redef exit_only_after_terminate = T; | ||
|
||
type InfoType: record { | ||
ts: time; | ||
uid: string; | ||
duration: interval; | ||
}; | ||
|
||
event line(description: Input::EventDescription, tpe: Input::Event, r: InfoType) | ||
{ | ||
print r; | ||
} | ||
|
||
event bro_init() | ||
{ | ||
Input::add_event([$source="select ts, uid, duration from conn;", $name="postgres", $fields=InfoType, $ev=line, $want_record=T, | ||
$reader=Input::READER_POSTGRESQL, $config=table(["dbname"]="testdb")]); | ||
} | ||
|
||
event Input::end_of_data(name: string, source:string) | ||
{ | ||
print "End of data"; | ||
terminate(); | ||
} | ||
``` | ||
|
||
By default, the plugin connects to PostgreSQL as the user running Bro, | ||
without supplying any additional username or password. | ||
|
||
# bro -N Johanna::PostgreSQL | ||
Johanna::PostgreSQL - PostgreSQL log writer and input reader (dynamic, version 0.1) | ||
Type mapping | ||
============ | ||
|
||
Usage | ||
----- | ||
The writer automatically maps the Bro types to the following PostgreSQL data | ||
types: | ||
|
||
The easiest way to add logging to PostgreSQL is to add a logging filter. An | ||
example, to also push the conn.log to PostgreSQL is: | ||
<table> | ||
<tr> | ||
<th>Bro type</th> | ||
<th>PostgreSQL type</th> | ||
</tr><tr><td>Bool</td><td>boolean</td> | ||
</tr><tr><td>int</td><td>bigint</td> | ||
</tr><tr><td>count</td><td>bigint</td> | ||
</tr><tr><td>port</td><td>bigint</td> | ||
</tr><tr><td>addr</td><td>inet</td> | ||
</tr><tr><td>subnet</td><td>inet</td> | ||
</tr><tr><td>time</td><td>double precision</td> | ||
</tr><tr><td>interval</td><td>double precision</td> | ||
</tr><tr><td>double</td><td>double precision</td> | ||
</tr><tr><td>enum</td><td>text</td> | ||
</tr><tr><td>string</td><td>text/bytea</td> | ||
</tr><tr><td>func</td><td>text/bytea</td> | ||
</tr><tr><td>set[type]</td><td>type[]</td> | ||
</tr><tr><td>vector[type]</td><td>type[]</td> | ||
</tr> | ||
</table> | ||
|
||
.. console:: | ||
For string and func, bytea is used if the $config option "bytea_instead_of_text" | ||
is set. | ||
|
||
event bro_init() | ||
{ | ||
local filter: Log::Filter = [$name="postgres", $path="conn", $writer=Log::WRITER_POSTGRESQL, $config=table(["dbname"]="testdb")]; | ||
Log::add_filter(Conn::LOG, filter); | ||
} | ||
Configuration options: PostgreSQL Writer | ||
======================================== | ||
|
||
This will write to a database named testdb into the table named conn. To | ||
create this database, issue commands similar to:: | ||
The PostgreSQL writer supports the following configuration options that can be | ||
passed in $config: | ||
|
||
initdb testdb | ||
postgres -D testdb | ||
createdb testdb | ||
- *hostname*: hostname to connect to | ||
|
||
The table will automatically be created if it does not exist. | ||
- *port*: port to connect to | ||
|
||
To read back this data, use a script like this: | ||
- *dbname*: name of database to connect to | ||
|
||
.. console:: | ||
- *conninfo*: connection string using parameter key words as defined in | ||
https://www.postgresql.org/docs/9.3/static/libpq-connect.html. Can be used | ||
to pass usernames, passwords, etc. hostname, port, and dbname are ignored if | ||
conninfo is specified. | ||
|
||
redef exit_only_after_terminate = T; | ||
Example: host=127.0.0.1 user=johanna | ||
|
||
type InfoType: record { | ||
ts: time; | ||
uid: string; | ||
duration: interval; | ||
}; | ||
- *sql_addition*: SQL string that is appended to the insert statement | ||
generated by the plugin. This can be used to specify a conflict clause | ||
like: "ON CONFLICT DO NOTHING" | ||
|
||
event line(description: Input::EventDescription, tpe: Input::Event, r: InfoType) | ||
{ | ||
print r; | ||
} | ||
- *continue_on_errors*: ignore insert errors and do not kill the database | ||
connection. | ||
|
||
event bro_init() | ||
{ | ||
Input::add_event([$source="select ts, uid, duration from conn;", $name="postgres", $fields=InfoType, $ev=line, $want_record=T, | ||
$reader=Input::READER_POSTGRESQL, $config=table(["dbname"]="testdb")]); | ||
} | ||
- *bytea_instead_of_text*: write strings/funcs to as bytea instead of text. | ||
|
||
event Input::end_of_data(name: string, source:string) | ||
{ | ||
print "End of data"; | ||
terminate(); | ||
} | ||
Configuration options: PostgreSQL Reader | ||
======================================== | ||
|
||
Please note that the plugin connects to PostgreSQL as the user running Bro, | ||
without supplying any additional username or password. | ||
The PostgreSQL reader supports the following configuration options that can be | ||
passed in $config: | ||
|
||
- *hostname*: hostname to connect to | ||
|
||
- *port*: port to connect to | ||
|
||
- *dbname*: name of database to connect to | ||
|
||
- *conninfo*: connection string using parameter key words as defined in | ||
https://www.postgresql.org/docs/9.3/static/libpq-connect.html. Can be used | ||
to pass usernames, passwords, etc. hostname, port, and dbname are ignored if | ||
conninfo is specified. | ||
|
||
Example: host=127.0.0.1 user=johanna |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters