System logs

For system logs, the danger level is determined for each message. The danger level intervals specified by the parameters are viewed in order from highest to lowest. The message level is determined by the first match found (remember that the trigger is triggered when the metric is OUTSIDE the interval). If no match is found, the message is not output to the system log.

Based on the level found, the priority of the message and its tag (prefix) are determined. A message with the specified priority and tag is sent to the system log using the logger command:

# logger -p priority -t tag "tag: message"

In addition to the main message for icigna, the following are generated:

○

a list of offending users;

○

shortened messages for detail level 1.

icigna logs

The formats of messages and exit codes of the plugin are described in Plugin Output for Nagios https://nagios-plugins.org/doc/guidelines.html#PLUGOUTPUT.

The severity level for icigna logs is determined by the TOTAL metric. The total metric is determined to determine the level and compared with the intervals specified by the flags

○

-c - Critical

○

-w - Warning

If no match is found, icigna prints the message:

POLICY OK: Containerization policies are not violated

The program exit code (which is processed on the icigna server side) is 0.

The log format for nagios depends on the level of detail specified by the -v[vv] flag (see Verbose Output https://nagios-plugins.org/doc/guidelines.html#AEN41):

Flag | Level
-----|--------
none | 0
-v   | 1
-vv  | 2
-vvv | 3
...  | 3

For all levels, a prefix message of the following format is generated:

POLICY $prefix:

Where prefix takes the following values ​​depending on the severity level:

○

-c - Critical

○

-w - Warning

If the level of detail is 0, a shortened message is output.

POLICY $prefix: Violation of user containerization policies users

Where users is a list of users for whom violations were detected.

If the detail level is 1, then the first detail level from the list of shortened messages generated during the formation of system logs is added to the message with the prefix There are users:.

POLICY $prefix: Violation of user containerization policies $users | There are users:
shortened message
...

If the detail level is 2, then the second detail level from the list of full messages generated during the formation of system logs is added to the message.

POLICY $prefix: Violation of user containerization policies $users | There are users:
shortened message
...
shortened message |
full message
...

After displaying messages, the plugin exits with the exit code:

○

Critical - 2

○

Warning - 1

Starting the service via systemd/Timers

In addition to running the script via nagios, the script can be run via systemd/Timers.

The package includes the systemd files podsec-inotify-check-images.service, podsec-inotify-check-images.timer. The service file podsec-inotify-check-images.service describes a line in the ExecStart parameter describing the startup mode of the podsec-inotify-check-images script. The script is run with the flags -vvv -c 100 - display detailed information, all messages have a level of c - critical. If incorrect policy settings are detected during the script´s operation, they are written to the system log and sent by mail to the system administrator (root).

The schedule for starting the podsec-inotify-check-images.service service is described in the OnCalendar parameter of the podsec-inotify-check-images.timer schedule file. The service is called every hour.

By default, the service start timer is disabled. To enable it, enter the command:

# systemctl enable --now podsec-inotify-check-images.timer

If you need to change the script startup mode, edit the OnCalendar parameter of the podsec-inotify-check-images.timer schedule file.